mileszs/wicked_pdf — pull request #311 by rst (2014-06-19 23:16:01+00:00)
Title: Assemble wkhtmltopdf command as array of options, not a string.

The code previously did the moral equivalent of

Open3.popen3("#{@exe_path} ... #{parse_options(options)} ...")

This causes a shell (e.g. bash on Linux boxes) to interpret the string,
which means that shell metacharacters in the values of some of the options
(e.g., ``) to cause weird and potentially dangerous effects. Handing
popen3 a pre-parsed array of arguments gets the shell out of the way,
and eliminates the danger.