Don't execute untar_to() subprocesses through the shell

planemo/commands/cmd_project_init.py

@@ -14,8 +14,6 @@
 
 SOURCE_HOST = "https://codeload.github.com"
 DOWNLOAD_URL = "%s/galaxyproject/planemo/tar.gz/master" % SOURCE_HOST
-UNTAR_FILTER = "--strip-components=2"
-UNTAR_ARGS = " -C %s -zxf - " + UNTAR_FILTER
 
 
 @click.command("project_init")
@@ -38,9 +36,9 @@ def cli(ctx, path, template=None, **kwds):
         return
 
     tempdir = tempfile.mkdtemp()
+    tar_args = ['-zxf', '-', '--strip-components=2']
     try:
-        untar_args = UNTAR_ARGS % (tempdir)
-        untar_to(DOWNLOAD_URL, tempdir, untar_args)
+        untar_to(DOWNLOAD_URL, tar_args=tar_args, dest_dir=tempdir)
         template_dir = os.path.join(tempdir, template)
         for entry in os.listdir(template_dir):
             shutil.move(os.path.join(template_dir, entry), path)

planemo/github_util.py

@@ -104,7 +104,7 @@ def _try_download_hub(planemo_hub_path):
     link = _hub_link()
     # Strip URL base and .tgz at the end.
     basename = link.split("/")[-1].rsplit(".", 1)[0]
-    untar_to(link, tar_args="-Ozxvf - %s/bin/hub > '%s'" % (basename, planemo_hub_path))
+    untar_to(link, tar_args=['-zxvf', '-', "%s/bin/hub" % basename], path=planemo_hub_path)
     communicate(["chmod", "+x", planemo_hub_path])
 
 

planemo/io.py

@@ -6,6 +6,7 @@
 import fnmatch
 import os
 import shutil
+import subprocess
 import sys
 import tempfile
 import time
@@ -96,17 +97,28 @@ def write_file(path, content, force=True):
         f.write(content)
 
 
-def untar_to(url, path=None, tar_args=None):
-    download_cmd = " ".join(download_command(url, quote_url=True))
+def untar_to(url, tar_args=None, path=None, dest_dir=None):
     if tar_args:
+        assert not (path and dest_dir)
+        if dest_dir:
+            if not os.path.exists(dest_dir):
+                os.makedirs(dest_dir)
+            tar_args.extend(['-C', dest_dir])
         if path:
-            if not os.path.exists(path):
-                os.makedirs(path)
+            tar_args.append('-O')
 
-        untar_cmd = "tar %s" % tar_args
-        shell("%s | %s" % (download_cmd, untar_cmd))
+        download_cmd = download_command(url)
+        download_p = commands.shell_process(download_cmd, stdout=subprocess.PIPE)
+        untar_cmd = ['tar'] + tar_args
+        if path:
+            with open(path, 'wb') as fh:
+                shell(untar_cmd, stdin=download_p.stdout, stdout=fh)
+        else:
+            shell(untar_cmd, stdin=download_p.stdout)
+        download_p.wait()
     else:
-        shell("%s > '%s'" % (download_cmd, path))
+        cmd = download_command(url, to=path)
+        shell(cmd)
 
 
 def find_matching_directories(path, pattern, recursive):

planemo/shed/interface.py

@@ -105,10 +105,10 @@ def download_tar(tsi, repo_id, destination, to_directory):
         base_url += "/"
     download_url = REPOSITORY_DOWNLOAD_TEMPLATE % (base_url, repo_id)
     if to_directory:
-        untar_args = "-xzf - -C %s --strip-components 1" % destination
+        tar_args = ['-xzf', '-', '--strip-components=1']
+        untar_to(download_url, tar_args=tar_args, dest_dir=destination)
     else:
-        untar_args = None
-    untar_to(download_url, destination, untar_args)
+        untar_to(download_url, path=destination)
 
 
 def _user(tsi):