TYPO3 Core

During a FAL code sprint, we discovered that t3lib_extFileFunc does not escape file names when using them for exec calls. This could possibly lead to unwanted side-effects.

See e.g. this snippet from func_copy():

if ($this->PHPFileFunctions) {
    copy($theFile, $theDestFile);
} else {
    $cmd = 'cp "' . $theFile . '" "' . $theDestFile . '"';
    t3lib_utility_Command::exec($cmd);
}

$theFile and $theDestFile are not escaped anywhere; from what I read in t3lib_utility_Command::imageMagickCommand(), I guess we would have to use escapeshellarg() here.