escape file path before passing it to shell

diff --git a/lib/pronto/eslint.rb b/lib/pronto/eslint.rb
index fa4261d184108e137830a7f993d4aea67e79b4cd..d57a4083c5a118599f6c3f8728deb080bc92c098 100644 (file)
--- a/lib/pronto/eslint.rb
+++ b/lib/pronto/eslint.rb
@@ -16,7 +16,7 @@ module Pronto
 
       offences =
         Dir.chdir(@_repo_path) do
-          JSON.parse(`eslint #{patch.new_file_full_path} -f json`)
+          JSON.parse(`eslint #{Shellwords.escape(patch.new_file_full_path)} -f json`)
         end
 
       offences =