From 2d35397195f1b959e91d5a6c18676d479a5d837e Mon Sep 17 00:00:00 2001
From: Qball Cow <qball@blame.services>
Date: Thu, 22 Feb 2024 09:13:05 +0100
Subject: [PATCH] [RUN] shell escape command before processing it further.

---
 source/modes/run.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/source/modes/run.c b/source/modes/run.c
index 4bc5ec038..581a9a5ca 100644
--- a/source/modes/run.c
+++ b/source/modes/run.c
@@ -444,12 +444,17 @@ static ModeMode run_mode_result(Mode *sw, int mretv, char **input,
                                    &path);
       if (retv == MODE_EXIT) {
         if (path == NULL) {
-          exec_cmd(rmpd->cmd_list[rmpd->selected_line].entry, run_in_term);
+          char *arg = g_shell_quote(rmpd->cmd_list[rmpd->selected_line].entry);
+          exec_cmd(arg, run_in_term);
+          g_free(arg);
         } else {
-          char *arg = g_strdup_printf(
-              "%s '%s'", rmpd->cmd_list[rmpd->selected_line].entry, path);
+          char *earg = g_shell_quote(rmpd->cmd_list[rmpd->selected_line].entry);
+          char *epath = g_shell_quote(path);
+          char *arg = g_strdup_printf("%s %s", earg, epath);
           exec_cmd(arg, run_in_term);
           g_free(arg);
+          g_free(earg);
+          g_free(epath);
         }
       }
       g_free(path);
@@ -458,9 +463,11 @@ static ModeMode run_mode_result(Mode *sw, int mretv, char **input,
   }
 
   if ((mretv & MENU_OK) && rmpd->cmd_list[selected_line].entry != NULL) {
-    if (!exec_cmd(rmpd->cmd_list[selected_line].entry, run_in_term)) {
+    char *earg = g_shell_quote(rmpd->cmd_list[selected_line].entry);
+    if (!exec_cmd(earg, run_in_term)) {
       retv = RELOAD_DIALOG;
     }
+    g_free(earg);
   } else if ((mretv & MENU_CUSTOM_INPUT) && *input != NULL &&
              *input[0] != '\0') {
     if (!exec_cmd(*input, run_in_term)) {