Merge pull request #171 from reinh/patch-1

Shell escape filename when given to shasum
contribsys · Oct 11, 2018 · 419d298 · 419d298
2 parents 71472bc + 9a5dfbd
commit 419d298
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/.github/notes.rb b/.github/notes.rb
@@ -1,4 +1,5 @@
 require 'erb'
+require 'shellwords'
 
 # GitHub release notes auto-generator
 # Use like `ruby notes.rb 0.9.0`
@@ -11,7 +12,7 @@
 Dir["packaging/output/systemd/*"].each do |fullname|
   name = File.basename(fullname)
 
-  output = `shasum -p -a 256 #{fullname}`
+  output = `shasum -p -a 256 #{Shellwords.escape(fullname)}`
   if $?.exitstatus != 0
     raise output
   end