nitiwiki: protect arguments of sys.system

Signed-off-by: Jean Privat <jean@pryen.org>

diff --git a/contrib/nitiwiki/src/nitiwiki.nit b/contrib/nitiwiki/src/nitiwiki.nit
index 803da02..d9c8343 100644 (file)
--- a/contrib/nitiwiki/src/nitiwiki.nit
+++ b/contrib/nitiwiki/src/nitiwiki.nit
@@ -107,7 +107,7 @@ if opt_init.value then
                print "You can initialize nitiwiki manually by copying the default skeletton here."
                exit 1
        end
-       sys.system "cp -R {tpl}/* ."
+       sys.system "cp -R -- {tpl.escape_to_sh}/* ."
        print "Initialized new nitiwiki."
        print "Set wiki settings by editing {config_filename}."
        exit 0

diff --git a/contrib/nitiwiki/src/wiki_base.nit b/contrib/nitiwiki/src/wiki_base.nit
index 21c4f32..6d7718b 100644 (file)
--- a/contrib/nitiwiki/src/wiki_base.nit
+++ b/contrib/nitiwiki/src/wiki_base.nit
@@ -50,12 +50,13 @@ class Nitiwiki
        # Synchronize local output with the distant `WikiConfig::rsync_dir`.
        fun sync do
                var root = expand_path(config.root_dir, config.out_dir)
-               sys.system "rsync -vr --delete {root}/ {config.rsync_dir}"
+               var rsync_dir = config.rsync_dir
+               sys.system "rsync -vr --delete -- {root.escape_to_sh}/ {rsync_dir.escape_to_sh}"
        end
 
        # Pull data from git repository.
        fun fetch do
-               sys.system "git pull {config.git_origin} {config.git_branch}"
+               sys.system "git pull {config.git_origin.escape_to_sh} {config.git_branch.escape_to_sh}"
        end
 
        # Analyze wiki files from `dir` to build wiki entries.

diff --git a/contrib/nitiwiki/src/wiki_html.nit b/contrib/nitiwiki/src/wiki_html.nit
index 2f425f0..2e96567 100644 (file)
--- a/contrib/nitiwiki/src/wiki_html.nit
+++ b/contrib/nitiwiki/src/wiki_html.nit
@@ -36,7 +36,7 @@ redef class Nitiwiki
                var src = expand_path(config.root_dir, config.assets_dir)
                var out = expand_path(config.root_dir, config.out_dir)
                if need_render(src, expand_path(out, config.assets_dir)) then
-                       if src.file_exists then sys.system "cp -R {src} {out}"
+                       if src.file_exists then sys.system "cp -R -- {src.escape_to_sh} {out.escape_to_sh}"
                end
        end
 
@@ -83,7 +83,7 @@ redef class WikiSection
                if is_new then
                        out_full_path.mkdir
                else
-                       sys.system "touch {out_full_path}"
+                       sys.system "touch -- {out_full_path.escape_to_sh}"
                end
                if has_source then
                        wiki.message("Render section {name} -> {out_path}", 1)
@@ -109,7 +109,7 @@ redef class WikiSection
                        var src = wiki.expand_path(dir, name)
                        var out = wiki.expand_path(out_full_path, name)
                        if not wiki.need_render(src, out) then continue
-                       sys.system "cp -R {src} {out_full_path}"
+                       sys.system "cp -R -- {src.escape_to_sh} {out_full_path.escape_to_sh}"
                end
        end