Add missing calls to the shellescape() function (#1099)

* Improve "g:NERDTreeQuickLook()"

The following improvements were made...

  - Use variable sigils
  - Shorten a local variable name
  - Prefer an early return over testing for a negative
  - Switch to single quotes
  - Call "shellescape()" to pass a command argument [IMPORTANT!]

The final change is a critical fix for the security and reliability
of this function (see ":h system()").

Similar fixes for the other functions in this script will follow.

* Improve "g:NERDTreeRevealInFinder()"

This commit makes several style improvements and adds a missing call
to the "shellescape()" function.

See also: 56cfbcff1e

* Improve "g:NERDTreeExecuteFile()"

Refer to: 56cfbcff1e

* Improve "g:NERDTreeRevealFileLinux()"

Refer to: 56cfbcff1e

* Improve "g:NERDTreeExecuteFileLinux()"

Refer to: 56cfbcff1e

* Properly reveal "/" on Linux

This commit handles the edge case where a user invokes the "reveal"
function on "/" on a Linux box.  There is nothing to do but open the
root directory itself since "/" has no parent.

* Update the "CHANGELOG.md" file

* Add final missing "shellescape()" calls

I initially thought that there were several more locations where
a call to "shellescape()" was required but omitted.  However, there
are only two.  I suppose I should have taken the time to look.

Fixing these was easy.  I would be surprised if this change breaks
anything on the user side.

* Update the "CHANGELOG.md" file (again)

Use a more fitting description of the change...

CHANGELOG.md

@@ -4,7 +4,14 @@
      version in an unordered list.  The format is:
         - **.PATCH**: Pull Request Title (PR Author) [PR Number](Link to PR)
 -->
+#### 6.7
+- **.4**: Add missing calls to the `shellescape()` function (lifecrisis) [#1099](https://github.com/preservim/nerdtree/pull/1099)
+- **.3**: Fix vsplit to not open empty buffers when opening previously closed file (AwkwardKore) [#1098](https://github.com/preservim/nerdtree/pull/1098)
+- **.2**: Fix infinity loop (on winvim) in FindParentVCSRoot (Eugenij-W) [#1095](https://github.com/preservim/nerdtree/pull/1095)
+- **.1**: File Move: Escape existing directory name when looking for open files. (PhilRunninger) [#1094](https://github.com/preservim/nerdtree/pull/1094)
+- **.0**: Open the parent directory when revealing a non-existent file with :NERDTreeFind (bouk) [#1090](https://github.com/preservim/nerdtree/pull/1090)
 #### 6.6
+- **.1**: [add] How to install using dein.vim (kazukazuinaina) [#1087](https://github.com/preservim/nerdtree/pull/1087)
 - **.0**: Add the ability to turn off directory arrows (PhilRunninger) [#1085](https://github.com/preservim/nerdtree/pull/1085)
 #### 6.5
 - **.0**: `NERDTreeToggle <start-directory>` always sets NERDTree root. (PhilRunninger) [#1083](https://github.com/preservim/nerdtree/pull/1083)

README.markdown

@@ -59,6 +59,13 @@ Plug 'preservim/nerdtree'
 call plug#end()
 ```
 
+#### [dein.vim](https://github.com/Shougo/dein.vim)
+```vim
+call dein#begin()
+call dein#add('preservim/nerdtree')
+call dein#end()
+```
+
 #### [apt-vim](https://github.com/egalpin/apt-vim)
 ```bash
 apt-vim install -y https://github.com/preservim/nerdtree.git

autoload/nerdtree/ui_glue.vim

@@ -284,6 +284,7 @@ endfunction
 " FUNCTION: s:findAndRevealPath(pathStr) {{{1
 function! s:findAndRevealPath(pathStr) abort
     let l:pathStr = !empty(a:pathStr) ? a:pathStr : expand('%:p')
+    let l:revealOpts = {}
 
     if empty(l:pathStr)
         call nerdtree#echoWarning('no file for the current buffer')
@@ -292,6 +293,7 @@ function! s:findAndRevealPath(pathStr) abort
 
     if !filereadable(l:pathStr)
         let l:pathStr = fnamemodify(l:pathStr, ':h')
+        let l:revealOpts['open'] = 1
     endif
 
     try
@@ -327,7 +329,7 @@ function! s:findAndRevealPath(pathStr) abort
         call b:NERDTree.ui.setShowHidden(1)
     endif
 
-    let l:node = b:NERDTree.root.reveal(l:pathObj)
+    let l:node = b:NERDTree.root.reveal(l:pathObj, l:revealOpts)
     call b:NERDTree.render()
     call l:node.putCursorHere(1, 0)
 endfunction

lib/nerdtree/opener.vim

@@ -195,7 +195,7 @@ function! s:Opener._newVSplit()
     endif
 
     call nerdtree#exec('wincmd p', 1)
-    call nerdtree#exec('vnew', 1)
+    call nerdtree#exec('vsplit', 1)
 
     let l:currentWindowNumber = winnr()
 

lib/nerdtree/path.vim

@@ -199,7 +199,7 @@ function! s:Path.copy(dest)
         let cmd_prefix = (self.isDirectory ? g:NERDTreeCopyDirCmd : g:NERDTreeCopyFileCmd)
     endif
 
-    let cmd = cmd_prefix . ' ' . escape(self.str(), self._escChars()) . ' ' . escape(a:dest, self._escChars())
+    let cmd = cmd_prefix . ' ' . shellescape(self.str()) . ' ' . shellescape(a:dest)
     let success = system(cmd)
     if v:shell_error !=# 0
         throw "NERDTree.CopyError: Could not copy '". self.str() ."' to: '" . a:dest . "'"

nerdtree_plugin/fs_menu.vim

@@ -209,7 +209,8 @@ function! NERDTreeMoveNode()
 
     try
         if curNode.path.isDirectory
-            let l:openBuffers = filter(range(1,bufnr('$')),'bufexists(v:val) && fnamemodify(bufname(v:val),":p") =~# curNode.path.str() . "/.*"')
+            let l:curPath = escape(curNode.path.str(),'\') . (nerdtree#runningWindows()?'\\':'/') . '.*'
+            let l:openBuffers = filter(range(1,bufnr('$')),'bufexists(v:val) && fnamemodify(bufname(v:val),":p") =~# "'.escape(l:curPath,'\').'"')
         else
             let l:openBuffers = filter(range(1,bufnr('$')),'bufexists(v:val) && fnamemodify(bufname(v:val),":p") ==# curNode.path.str()')
         endif
@@ -387,44 +388,67 @@ endfunction
 
 " FUNCTION: NERDTreeQuickLook() {{{1
 function! NERDTreeQuickLook()
-    let treenode = g:NERDTreeFileNode.GetSelected()
+    let l:node = g:NERDTreeFileNode.GetSelected()
-    if treenode !=# {}
+
-        call system("qlmanage -p 2>/dev/null '" . treenode.path.str() . "'")
+    if empty(l:node)
+        return
     endif
+
+    call system('qlmanage -p 2>/dev/null ' . shellescape(l:node.path.str()))
 endfunction
 
 " FUNCTION: NERDTreeRevealInFinder() {{{1
 function! NERDTreeRevealInFinder()
-    let treenode = g:NERDTreeFileNode.GetSelected()
+    let l:node = g:NERDTreeFileNode.GetSelected()
-    if treenode !=# {}
+
-        call system("open -R '" . treenode.path.str() . "'")
+    if empty(l:node)
+        return
     endif
+
+    call system('open -R ' . shellescape(l:node.path.str()))
 endfunction
 
 " FUNCTION: NERDTreeExecuteFile() {{{1
 function! NERDTreeExecuteFile()
-    let treenode = g:NERDTreeFileNode.GetSelected()
+    let l:node = g:NERDTreeFileNode.GetSelected()
-    if treenode !=# {}
+
-        call system("open '" . treenode.path.str() . "'")
+    if empty(l:node)
+        return
     endif
+
+    call system('open ' . shellescape(l:node.path.str()))
 endfunction
 
 " FUNCTION: NERDTreeRevealFileLinux() {{{1
 function! NERDTreeRevealFileLinux()
-    let treenode = g:NERDTreeFileNode.GetSelected()
+    let l:node = g:NERDTreeFileNode.GetSelected()
-    let parentnode = treenode.parent
+
-    if parentnode !=# {}
+    if empty(l:node)
-        call system("xdg-open '" . parentnode.path.str() . "' &")
+        return
     endif
+
+    " Handle the edge case of "/", which has no parent.
+    if l:node.path.str() ==# '/'
+        call system('xdg-open /')
+        return
+    endif
+
+    if empty(l:node.parent)
+        return
+    endif
+
+    call system('xdg-open ' . shellescape(l:node.parent.path.str()))
 endfunction
 
 " FUNCTION: NERDTreeExecuteFileLinux() {{{1
 function! NERDTreeExecuteFileLinux()
-    let treenode = g:NERDTreeFileNode.GetSelected()
+    let l:node = g:NERDTreeFileNode.GetSelected()
-    if treenode !=# {}
+
-        call system("xdg-open '" . treenode.path.str() . "' &")
+    if empty(l:node)
+        return
     endif
+
+    call system('xdg-open ' . shellescape(l:node.path.str()))
 endfunction
 
 " vim: set sw=4 sts=4 et fdm=marker:
-

nerdtree_plugin/vcs.vim

@@ -34,7 +34,7 @@ endfunction
 function! s:FindParentVCSRoot(path)
     let l:path = a:path
     while !empty(l:path) &&
-        \ l:path._str() !~# '^\(\a:\\\|\/\)$' &&
+        \ l:path._str() !~# '^\(\a:[\\\/]\|\/\)$' &&
         \ !isdirectory(l:path._str() . '/.git') &&
         \ !isdirectory(l:path._str() . '/.svn') &&
         \ !isdirectory(l:path._str() . '/.hg') &&
@@ -42,6 +42,6 @@ function! s:FindParentVCSRoot(path)
         \ !isdirectory(l:path._str() . '/_darcs')
         let l:path = l:path.getParent()
     endwhile
-    return (empty(l:path) || l:path._str() =~# '^\(\a:\\\|\/\)$') ? a:path : l:path
+    return (empty(l:path) || l:path._str() =~# '^\(\a:[\\\/]\|\/\)$') ? a:path : l:path
 endfunction