escaping filenames

index.js

@@ -1,6 +1,12 @@
 
 // gm - Copyright Aaron Heckmann <aaron.heckmann+github@gmail.com> (MIT Licensed)
 
+/**
+ * Module dependencies.
+ */
+
+var escape = require('./lib/utils').escape;
+
 /**
  * Constructor.
  *
@@ -32,6 +38,8 @@ function gm (source, height, color) {
     }
 
     this.arg(arg);
+  } else {
+    source = escape(source);
   }
 
   this.source = source;

lib/command.js

@@ -1,9 +1,12 @@
 
 // gm - Copyright Aaron Heckmann <aaron.heckmann+github@gmail.com> (MIT Licensed)
 
-// -- commandline
+/**
+ * Module dependencies.
+ */
 
 var exec = require('child_process').exec;
+var escape = require('./utils').escape;
 
 module.exports = function (proto) {
 
@@ -30,7 +33,10 @@ module.exports = function (proto) {
       throw new TypeError("gm().write() expects a filename when writing new files")
     }
 
-    this.outname = name;
+    if (name) {
+      this.outname = escape(name);
+    }
+
     return this._exec(this.cmd(), callback);
   }
 

lib/utils.js

@@ -0,0 +1,14 @@
+
+// gm - Copyright Aaron Heckmann <aaron.heckmann+github@gmail.com> (MIT Licensed)
+
+/**
+ * Escape the given shell `arg`.
+ *
+ * @param {String} arg
+ * @return {String}
+ * @api public
+ */
+
+exports.escape = function escape (arg) {
+  return '"' + String(arg).trim().replace(/"/g, '\\"') + '"';
+}