Fix problem with Image.stream() and Image.pipe().

petersirka · petersirka · commit ec9a984dfaf0 · 2016-12-15T23:12:23.000+01:00
diff --git a/image.js b/image.js
@@ -21,7 +21,7 @@
 
 /**
  * @module FrameworkImage
- * @version 2.3.0
+ * @version 2.4.0
  */
 
 'use strict';
@@ -34,6 +34,7 @@ const Fs = require('fs');
 const REGEXP_SVG = /(width=\"\d+\")+|(height=\"\d+\")+/g;
 const REGEXP_PATH = /\//g;
 const REGEXP_ARG = /\'/g;
+const REGEXP_ESCAPE = /\$\(.*?\)|\'/g;
 
 var CACHE = {};
 var middlewares = {};
@@ -303,9 +304,8 @@ Image.prototype.stream = function(type, writer) {
 	if (!type)
 		type = self.outputType;
 
-	// Possible vulnerability with self.filename.
-	// WTF?? I don't know why, but wrap(self.filename) doesn't work with spawn() - but it works with exec() and with another spawn in image.pipe()
-	var cmd = spawn(self.isIM ? 'convert' : 'gm', self.arg(self.filename ? self.filename : '-', (type ? type + ':' : '') + '-'));
+	var cmd = spawn(self.isIM ? 'convert' : 'gm', self.arg(self.filename ? wrap(self.filename) : '-', (type ? type + ':' : '') + '-'));
+
 	if (self.currentStream) {
 		if (self.currentStream instanceof Buffer)
 			cmd.stdin.end(self.currentStream);
@@ -314,12 +314,8 @@ Image.prototype.stream = function(type, writer) {
 	}
 
 	writer && writer(cmd.stdin);
-
 	var middleware = middlewares[type];
-	if (!middleware)
-		return cmd.stdout;
-
-	return cmd.stdout.pipe(middleware());
+	return middleware ? cmd.stdout.pipe(middleware()) : cmd.stdout;
 };
 
 Image.prototype.cmd = function(filenameFrom, filenameTo) {
@@ -394,9 +390,9 @@ Image.prototype.push = function(key, value, priority, encode) {
 
 	if (value != null) {
 		if (encode && typeof(value) === 'string')
-			cmd += wrap(value, true);
+			cmd += ' "' + value.replace(REGEXP_ESCAPE, '') + '"';
 		else
-			cmd += framework.isWindows ? ' "' + value + '"' : ' \'' + value + '\'';
+			cmd += ' ' + value;
 	}
 
 	var obj = CACHE[cmd];
@@ -630,11 +626,11 @@ Image.prototype.flop = function() {
 };
 
 Image.prototype.minify = function() {
-	return this.push('+profile', '*');
+	return this.push('+profile', '*', null, 10, true);
 };
 
 Image.prototype.grayscale = function() {
-	return this.push('-colorspace', 'Gray', 10);
+	return this.push('-colorspace', 'Gray', 10, true);
 };
 
 Image.prototype.bitdepth = function(value) {
@@ -658,7 +654,7 @@ Image.prototype.sepia = function() {
 };
 
 Image.prototype.watermark = function(filename, x, y, w, h) {
-	return this.push('-draw', 'image over {1},{2} {3},{4} \'{0}\''.format(filename, x || 0, y || 0, w || 0, h || 0), 6);
+	return this.push('-draw', 'image over {1},{2} {3},{4} \'{0}\''.format(filename, x || 0, y || 0, w || 0, h || 0), 6, true);
 };
 
 Image.prototype.make = function(fn) {
@@ -671,16 +667,7 @@ Image.prototype.command = function(key, value, priority, esc) {
 };
 
 function wrap(command, empty) {
-	var cmd = '';
-	if (framework.isWindows) {
-		for (var i = 0, length = command.length; i < length; i++)
-			cmd += command[i] === '\"' ? '\'' : command[i];
-		return (empty ? ' ' : '') + '"' + cmd + '"';
-	} else {
-		for (var i = 0, length = command.length; i < length; i++)
-			cmd += command[i] === '\'' ? '"' : command[i];
-		return (empty ? ' ' : '') + '\'' + cmd + '\'';
-	}
+	return (empty ? ' ' : '') + command.replace(REGEXP_ESCAPE, '');
 }
 
 exports.Image = Image;
