treewide: filter shell arguments through shellquote() where applicable

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

1 files changed, 6 insertions, 5 deletions

diff --git a/applications/luci-app-vnstat/luasrc/view/vnstat.htm b/applications/luci-app-vnstat/luasrc/view/vnstat.htm
index 2b8d9ff9c..42d7d2404 100644
--- a/applications/luci-app-vnstat/luasrc/view/vnstat.htm
+++ b/applications/luci-app-vnstat/luasrc/view/vnstat.htm
@@ -21,12 +21,13 @@ style = (style and #style > 0) and style or "s"
 -- render image
 --
 if iface then
-	style = style:gsub("[^%w]", "")
-	iface = iface:gsub("[^%w%.%-%_]", "")
-
 	luci.http.prepare_content("image/png")
 
-	local png = io.popen("vnstati -i '%s' '-%s' -o -" % { iface, style })
+	local png = io.popen("vnstati -i %s -%s -o -" %{
+		utl.shellquote(iface),
+		utl.shellquote(style)
+	})
+
 	luci.http.write(png:read("*a"))
 	png:close()
 
@@ -89,7 +90,7 @@ dbdir = dbdir or "/var/lib/vnstat"
 <%
        end
      end
-   end 
+   end
 %>
 
 <% if empty then %>