Avoid shell quoting issues when extracting xz and lz archives

1 files changed, 11 insertions, 2 deletions

diff --git a/Library/Homebrew/download_strategy.rb b/Library/Homebrew/download_strategy.rb
index e3db1e914..36c96acb4 100644
--- a/Library/Homebrew/download_strategy.rb
+++ b/Library/Homebrew/download_strategy.rb
@@ -174,10 +174,10 @@ class AbstractFileDownloadStrategy < AbstractDownloadStrategy
       with_system_path { safe_system 'tar', 'xf', cached_location }
       chdir
     when :xz
-      with_system_path { safe_system "#{xzpath} -dc \"#{cached_location}\" | tar xf -" }
+      with_system_path { pipe_to_tar(xzpath) }
       chdir
     when :lzip
-      with_system_path { safe_system "#{lzippath} -dc \"#{cached_location}\" | tar xf -" }
+      with_system_path { pipe_to_tar(lzippath) }
       chdir
     when :xar
       safe_system "/usr/bin/xar", "-xf", cached_location
@@ -200,6 +200,15 @@ class AbstractFileDownloadStrategy < AbstractDownloadStrategy
     end
   end
 
+  def pipe_to_tar(tool)
+    Utils.popen_read(tool, "-dc", cached_location.to_s) do |rd|
+      Utils.popen_write("tar", "xf", "-") do |wr|
+        buf = ""
+        wr.write(buf) while rd.read(16384, buf)
+      end
+    end
+  end
+
   # gunzip and bunzip2 write the output file in the same directory as the input
   # file regardless of the current working directory, so we need to write it to
   # the correct location ourselves.