phpseclib/phpseclib — pull request #527 by DavidAnderson684 (2014-12-04 16:50:41+00:00)
Title: Quote shell argument with escapeshellarg()

Currently, the call to "scp -t" or "scp -f" just uses naive quoting - i.e. a couple of quote marks are thrown in.

But, this can easily be escaped from - if the filename has a quote mark of its own in it, for example.

e.g. if the filename is as follows, then bad things will happen:

";rm -rf /

Instead, escapeshellarg should be used, to make sure it gets escaped properly.