Apply shell quoting to infile/outfile. #536

compressor/filters/base.py

@@ -3,6 +3,11 @@ import io
 import logging
 import subprocess
 
+try:
+    from shlex import quote as shell_quote  # Python 3
+except ImportError:
+    from pipes import quote as shell_quote  # Python 2
+
 from django.core.exceptions import ImproperlyConfigured
 from django.core.files.temp import NamedTemporaryFile
 from django.utils.importlib import import_module
@@ -147,6 +152,12 @@ class CompilerFilter(FilterBase):
             self.outfile = NamedTemporaryFile(mode='r+', suffix=ext)
             options["outfile"] = self.outfile.name
 
+        # Quote infile and outfile for spaces etc.
+        if "infile" in options:
+            options["infile"] = shell_quote(options["infile"])
+        if "outfile" in options:
+            options["outfile"] = shell_quote(options["outfile"])
+
         try:
             command = self.command.format(**options)
             proc = subprocess.Popen(

compressor/tests/static/css/filename with spaces.css

@@ -0,0 +1 @@
+body { background:#424242; }

compressor/tests/test_filters.py

@@ -47,10 +47,13 @@ class CssTidyTestCase(TestCase):
 
 class PrecompilerTestCase(TestCase):
     def setUp(self):
-        self.filename = os.path.join(test_dir, 'static/css/one.css')
+        self.test_precompiler = os.path.join(test_dir, 'precompiler.py')
+        self.setup_infile()
+
+    def setup_infile(self, filename='static/css/one.css'):
+        self.filename = os.path.join(test_dir, filename)
         with io.open(self.filename, encoding=settings.FILE_CHARSET) as file:
             self.content = file.read()
-        self.test_precompiler = os.path.join(test_dir, 'precompiler.py')
 
     def test_precompiler_infile_outfile(self):
         command = '%s %s -f {infile} -o {outfile}' % (sys.executable, self.test_precompiler)
@@ -59,6 +62,14 @@ class PrecompilerTestCase(TestCase):
             charset=settings.FILE_CHARSET, command=command)
         self.assertEqual("body { color:#990; }", compiler.input())
 
+    def test_precompiler_infile_with_spaces(self):
+        self.setup_infile('static/css/filename with spaces.css')
+        command = '%s %s -f {infile} -o {outfile}' % (sys.executable, self.test_precompiler)
+        compiler = CompilerFilter(
+            content=self.content, filename=self.filename,
+            charset=settings.FILE_CHARSET, command=command)
+        self.assertEqual("body { color:#424242; }", compiler.input())
+
     def test_precompiler_infile_stdout(self):
         command = '%s %s -f {infile}' % (sys.executable, self.test_precompiler)
         compiler = CompilerFilter(