lib/awestruct/extensions/minify.rb in awestruct-0.4.5 vs lib/awestruct/extensions/minify.rb in awestruct-0.4.6

@@ -1,5 +1,6 @@
+require 'shellwords'
 require 'fileutils'
 
 ##
 # Awestruct:Extensions:Minify is a transformer that minimizes JavaScript, CSS and HTML files.
 # The transform runs on the rendered stream before it's written to the output path.
@@ -94,11 +95,11 @@
             elsif not v === false
               cmd += " --#{p.gsub('_', '-')}=#{v}"
             end
           end
         end
-        Open3.popen3(cmd) do |stdin, stdout, stderr|
+        Open3.popen3(Shellwords.escape(cmd)) do |stdin, stdout, stderr|
           threads = []
           threads << Thread.new(stdout) do |o|
             while ( ! o.eof? )
               output << o.readline
             end
@@ -122,11 +123,11 @@
         end
       end
 
       def yuicompressor(page, input, type)
         output = ''
-        Open3.popen3("yuicompressor --type #{type}") do |stdin, stdout, stderr|
+        Open3.popen3("yuicompressor --type #{Shellwords.escape(type)}") do |stdin, stdout, stderr|
           threads = []
           threads << Thread.new(stdout) do |o|
             while ( ! o.eof? )
               output << o.readline
             end
@@ -150,10 +151,10 @@
         end
       end
 
       def pngcrush(page, input)
         filename = page.source_path
-        cmd = "pngcrush #{filename} /tmp/pngcrush"
+        cmd = Shellwords.escape("pngcrush #{filename} /tmp/pngcrush")
         `#{cmd}`
         if $?.exitstatus != 0
           raise "Failed to execute pngcrush: #{cmd}"
         end
         output = File.read('/tmp/pngcrush')