Fixed Command Injection

index.js

@@ -92,7 +92,7 @@ exports.request = function (options, callback) {
       , err
       , stderr = ''
       , stdoutlen
-      , stdout = new Buffer(stdoutlen = 0)
+      , stdout = new Buffer.alloc(stdoutlen = 0)
       , encoding
       , complete
       , cleanup

package.json

@@ -1,16 +1,24 @@
-{ "name"          : "curlrequest",
-  "description"   : "A curl wrapper for node",
-  "version"       : "1.0.1",
-  "homepage"      : "https://github.com/node-js-libs/curlrequest",
-  "author"        : "Chris O'Hara <cohara87@gmail.com>",
-  "main"          : "index",
+{
+  "name": "curlrequest",
+  "description": "A curl wrapper for node",
+  "version": "1.0.1",
+  "homepage": "https://github.com/node-js-libs/curlrequest",
+  "author": "Chris O'Hara <cohara87@gmail.com>",
+  "main": "index",
   "repository": {
     "type": "git",
     "url": "http://github.com/node-js-libs/curlrequest.git"
   },
-  "engines": { "node": ">= 0.4.0" },
-  "licenses": [{
-    "type": "MIT",
-    "url": "http://github.com/node-js-libs/curlrequest/raw/master/LICENSE"
-  }]
+  "engines": {
+    "node": ">= 0.4.0"
+  },
+  "licenses": [
+    {
+      "type": "MIT",
+      "url": "http://github.com/node-js-libs/curlrequest/raw/master/LICENSE"
+    }
+  ],
+  "dependencies": {
+    "shell-escape": "^0.2.0"
+  }
 }

spawn.js

@@ -1,4 +1,5 @@
 var child = require('child_process');
+var shellescape = require('shell-escape');
 
 /**
  * Limit the amount of processes that can be spawned per tick.
@@ -13,7 +14,7 @@ var spawned = 0
  */
 
 module.exports = function (cmd, args, options, callback) {
-    var args = Array.prototype.slice.call(arguments);
+    var args = shellescape(Array.prototype.slice.call(arguments));
     if (spawned < max_per_tick) {
         spawned++;
         callback(child.spawn.apply(child, args.slice(0, -1)));