Final pass at string sanitization?

emericg · Apr 29, 2014 · 8e8633d · 8e8633d
1 parent 164ec56
commit 8e8633d
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/OpenSubtitlesDownload.py b/OpenSubtitlesDownload.py
@@ -509,8 +509,13 @@ def selectionAuto(subtitlesList):
 
             # Title and filename may need string sanitizing to avoid zenity/kdialog handling errors
             if gui != 'cli':
+                videoTitle = videoTitle.replace('"', '\\"')
+                videoTitle = videoTitle.replace("'", "\'")
+                videoTitle = videoTitle.replace('`', '\`')
                 videoTitle = videoTitle.replace("&", "&amp;")
-                videoFileName = re.escape(videoFileName)
+                videoFileName = videoFileName.replace('"', '\\"')
+                videoFileName = videoFileName.replace("'", "\'")
+                videoFileName = videoFileName.replace('`', '\`')
                 videoFileName = videoFileName.replace("&", "&amp;")
 
             # If there is more than one subtitles and opt_selection_mode != 'auto',
@@ -561,13 +566,15 @@ def selectionAuto(subtitlesList):
                 subLangName = subtitlesList['data'][subIndex]['LanguageName']
                 subURL = subtitlesList['data'][subIndex]['SubDownloadLink']
                 subPath = videoPath.rsplit('.', 1)[0] + '.' + subtitlesList['data'][subIndex]['SubFormat']
-                subPath = re.escape(subPath)
 
                 # Write language code into the filename?
                 if ((opt_write_languagecode == 'on') or
                     (opt_write_languagecode == 'auto' and searchLanguageResult > 1)):
                     subPath = videoPath.rsplit('.', 1)[0] + subLangId + '.' + subtitlesList['data'][subIndex]['SubFormat']
 
+                # Escape non-alphanumeric characters from the subtitles path
+                subPath = re.escape(subPath)
+
                 # Download and unzip the selected subtitles (with progressbar)
                 if gui == 'gnome':
                     process_subtitlesDownload = subprocess.call("(wget -q -O - " + subURL + " | gunzip > " + subPath + ") 2>&1" + ' | (zenity --auto-close --progress --pulsate --title="Downloading subtitles, please wait..." --text="Downloading <b>' + subtitlesList['data'][subIndex]['LanguageName'] + '</b> subtitles for <b>' + videoTitle + '</b>...")', shell=True)