Skip to content

Conversation

@ysbaddaden
Copy link
Collaborator

Introduces the Process.capture method that executes a command, captures its standard output, and returns it or raises an exception when the command fails (unsuccessful exit status).

The method provides a safer replacement to the command operator (aka backticks) that has the following issues:

  1. requires the command be executed in a shell, which in turn requires manual escapes and is prone to command injection;

  2. doesn't check the exit status... while callers don't check it either, and errors get unnoticed.

The method is kept simple on purpose: it expects a command to always succeed (happy path) and to print to its standard output. Anything else (capture output + error, merge error -> output, act on error status) are better handled by .new and .run.

Example:

path = ARGV[0]
output = Process.capture("ls", {"-al", path})

NOTE: please discuss the design in #7171.

This draft PR also provides a commit that refactors the compiler/std specs to replace all usages of the command operator and shell: true arg, so we can evaluate the benefits of the change. It shall indeed be extracted into a follow-up PR.

Closes #7171.
Related to #16614.

@ysbaddaden ysbaddaden force-pushed the feature/process-capture-output branch from c5145db to b8b3b97 Compare February 3, 2026 15:16
This is a safer alternative to the command operator (or backtick
operator) with no need for a shell intermediary and that raises when the
command failed (non successful exit code) so we don't have to check the
process status (but can do so with `$!`).
@ysbaddaden ysbaddaden force-pushed the feature/process-capture-output branch from ca3484e to 221fb72 Compare February 5, 2026 10:12
Prefer explicit and safer calls to `Process.capture` and `Process.new`.
@ysbaddaden ysbaddaden force-pushed the feature/process-capture-output branch from 221fb72 to fd521da Compare February 5, 2026 13:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

A safe alternative for capturing child process output

1 participant