fix: run the binary directly in verify_binary instead of through a shell (CWE-78)

verify_binary built its command by string concatenation:

    IO.popen(bin_path + " --version")

The single-string form of IO.popen hands the whole thing to /bin/sh, so any
shell metacharacter in the binary path is interpreted rather than treated as
part of a filename. bin_path is assembled from @ordered_paths — the expanded
home directory, Dir.pwd and Dir.tmpdir — none of which are sanitised, so a
directory name containing ";" or "$()" turns a routine version check into
arbitrary command execution. Reproduced end to end through the public
LocalBinary#binary_path entry point.

The array form execs the binary directly and never involves a shell, which
also fixes a long-standing benign failure: a path containing a space (common
on macOS and Windows) used to be split by the shell, so verification of a
perfectly good cached binary failed and the binary was deleted and
re-downloaded on every run.

Deliberately not changed here, each tracked separately: the fail-open rescue
in this same method, the TOCTOU window between verification and execution,
and the other shell-string call sites in local.rb. A character allowlist on
the path was considered and rejected — with no shell involved it adds nothing,
and it would reject the legitimate space-containing paths this change fixes.

Adds two regression tests, both verified to fail before this change.

Author: 07souravkunda

lib/browserstack/localbinary.rb

@@ -133,7 +133,9 @@ def download_to(url, bin_path)
   end
 
   def verify_binary(bin_path)
-    binary_response = IO.popen(bin_path + " --version").readline
+    # Array form: exec's the binary directly, so a path containing shell
+    # metacharacters or spaces is never interpreted by /bin/sh (CWE-78).
+    binary_response = IO.popen([bin_path, '--version']).readline
     !!(binary_response =~ /BrowserStack Local version \d+\.\d+/)
   rescue StandardError
     false

test/browserstack-local-test.rb

@@ -159,6 +159,37 @@ def test_local_binary_accepts_proxy_conf
     assert_equal 8080, bin.instance_variable_get(:@proxy_port)
   end
 
+  # Regression: verify_binary must exec the binary directly, never via a shell,
+  # so shell metacharacters in the cached-binary path cannot run commands (CWE-78).
+  def test_verify_binary_does_not_interpret_shell_metacharacters_in_path
+    marker = File.join(Dir.tmpdir, "bs_local_verify_injection_#{Process.pid}")
+    File.delete(marker) if File.exist?(marker)
+    injected = "/nonexistent;touch #{marker};echo BrowserStack Local version 9.9;#"
+
+    assert_equal false, BrowserStack::LocalBinary.new(auth_token: 'fake').send(:verify_binary, injected)
+    refute File.exist?(marker), 'shell metacharacters in the binary path were executed'
+  ensure
+    File.delete(marker) if marker && File.exist?(marker)
+  end
+
+  # Same fix, benign side: a legitimate path containing spaces must still verify
+  # (the shell used to split it and the check failed for every such user).
+  def test_verify_binary_accepts_a_path_containing_spaces
+    skip 'needs a POSIX shell to stand in for the binary' if Gem.win_platform?
+
+    base = Dir.mktmpdir('bs_local')
+    dir = File.join(base, 'my binary dir')
+    FileUtils.mkdir_p(dir)
+    bin = File.join(dir, 'BrowserStackLocal')
+    File.write(bin, "#!/bin/sh\necho 'BrowserStack Local version 9.9'\n")
+    FileUtils.chmod(0755, bin)
+
+    assert_includes bin, ' '
+    assert_equal true, BrowserStack::LocalBinary.new(auth_token: 'fake').send(:verify_binary, bin)
+  ensure
+    FileUtils.remove_entry(base) if base && File.directory?(base)
+  end
+
   private
 
   def with_host_config(host_os, host_cpu)