Avoid shell expansions of wget arguments

diff --git a/file-fetcher.pl b/file-fetcher.pl
index 92f4b8f5f941a3caaf46f95b8e62d0e4e4ba86c2..60150130c1bbedfa89b585d4e5351f481ed1d06f 100755 (executable)
--- a/file-fetcher.pl
+++ b/file-fetcher.pl
@@ -224,8 +224,10 @@ sub fetch_file($$)
   my $all_out = "";
   my $bn = basename($url);
   my $local = "$tmp_dir/$md5/$bn";
-  my $cmd = "wget -nv --no-check-certificate --user-agent=$user_agent -O $local \"$url\"";
-  my $cmd2 = "wget -nv --no-check-certificate --user-agent=$user_agent --passive-ftp -O $local \"$url\"";
+  my @cmd = ("wget", "-nv", "--no-check-certificate", "--user-agent=$user_agent", "-O", $local, $url);
+  my $cmd_joined = join(' ', @cmd);
+  my @cmd2 = ("wget",  "-nv", "--no-check-certificate", "--user-agent=$user_agent", "--passive-ftp", "-O", $local, $url);
+  my $cmd2_joined = join(' ', @cmd2);
 
   push @files, $bn;
 
@@ -251,7 +253,12 @@ sub fetch_file($$)
     return;
   }
 
-  open(W, "$cmd 2>&1 |");
+  my $pid = open(W, "-|");
+  die "Cannot fork $!" unless defined $pid;
+  unless ( $pid ) {
+    open STDERR, ">&", \*STDOUT  or die "$0: open: $!";
+    exec { $cmd[0] } @cmd or die "$0: exec: $!";
+  }
   while (<W>) {
     $all_out .= $_;
     /URL:.*\s+\-\>\s+.*/ and next;
@@ -259,17 +266,22 @@ sub fetch_file($$)
   }
   close(W);
   if ($out ne "") {
-    $problems .= "$cmd:\n$out\n\n";
+    $problems .= "$cmd_joined:\n$out\n\n";
   }
   if ( $? ) {
     $problems .= sprintf "%s:\nexited with code %d (0x%02x)\n\n",
-      $cmd,
+      $cmd_joined,
       $? >> 8,
       $? & 0xff;
   }
   if (-f $local && -s $local == 0 && $url =~ /^ftp:/) {
     $out = "";
-    open(W, "$cmd2 2>&1 |");
+    my $pid = open(W, "-|");
+    die "Cannot fork $!" unless defined $pid;
+    unless ( $pid ) {
+      open STDERR, ">&", \*STDOUT  or die "$0: open: $!";
+      exec { $cmd2[0] } @cmd2 or die "$0: exec: $!";
+    }
     while (<W>) {
       $all_out .= "\n\t\t$_";
       /URL:.*\s+\-\>\s+.*/ and next;
@@ -277,11 +289,11 @@ sub fetch_file($$)
     }
     close(W);
     if ($out ne "") {
-      $problems .= "$cmd2:\n$out\n\n";
+      $problems .= "$cmd2_joined:\n$out\n\n";
     }
     if ( $? ) {
       $problems .= sprintf "%s:\nexited with code %d (0x%02x)\n\n",
-        $cmd2,
+        $cmd2_joined,
         $? >> 8,
         $? & 0xff;
     }
@@ -306,11 +318,11 @@ sub fetch_file($$)
       }
     }
   } elsif (-f $local && -s $local > 0) {
-    $problems .= "FATAL: $url ($md5) was not fetched correctly ($cmd: $all_out): file is not readable\n";
+    $problems .= "FATAL: $url ($md5) was not fetched correctly ($cmd_joined: $all_out): file is not readable\n";
   } elsif (-f $local && not -s $local) {
-    $problems .= "FATAL: $url ($md5) was not fetched correctly ($cmd: $all_out): file fetched but has 0 length\n";
+    $problems .= "FATAL: $url ($md5) was not fetched correctly ($cmd_joined: $all_out): file fetched but has 0 length\n";
   } else {
-    $problems .= "FATAL: $url ($md5) was not fetched correctly ($cmd: $all_out)\n";
+    $problems .= "FATAL: $url ($md5) was not fetched correctly ($cmd_joined: $all_out)\n";
   }
   # save space
   unlink($local);