fix shell command escaping in sql task and spec_helper

Author: sheenaajay

spec/spec_helper_local.rb

@@ -33,7 +33,7 @@
     # this could definitely be optimized
     add_filter do |f|
       # system returns true if exit status is 0, which with git-check-ignore means file is ignored
-      system("git check-ignore --quiet #{f.filename}")
+      system('git', 'check-ignore', '--quiet', f.filename)
     end
   end
 end

tasks/sql.rb

@@ -8,12 +8,12 @@
 def get(sql, database, user, port, password, host)
   env_hash = {}
   env_hash['PGPASSWORD'] = password unless password.nil?
-  cmd_string = "psql -c \"#{sql}\""
-  cmd_string += " --dbname=#{database}" unless database.nil?
-  cmd_string += " --username=#{user}" unless user.nil?
-  cmd_string += " --port=#{port}" unless port.nil?
-  cmd_string += " --host=#{host}" unless host.nil?
-  stdout, stderr, status = Open3.capture3(env_hash, cmd_string)
+  cmd_string = ['psql', '-c', sql]
+  cmd_string << "--dbname=#{database}" unless database.nil?
+  cmd_string << "--username=#{user}" unless user.nil?
+  cmd_string << "--port=#{port}" unless port.nil?
+  cmd_string << "--host=#{host}" unless host.nil?
+  stdout, stderr, status = Open3.capture3(env_hash, *cmd_string)
   raise Puppet::Error, stderr if status != 0
   { status: stdout.strip }
 end