136 if tarfile =~# '\.\(gz\|tgz\)$' 137 " call Decho("1: exe silent r! gzip -d -c ".s:Escape(tarfile)." | ".g:tar_cmd." -".g:tar_browseoptions." - ") *138 exe "silent r! gzip -d -c -- ".s:Escape(tarfile)." | ".g:tar_cmd." -".g:tar_browseoptions." - " 139 elseif tarfile =~# '\.lrp' 140 " call Decho("2: exe silent r! cat -- ".s:Escape(tarfile)."|gzip -d -c -|".g:tar_cmd." -".g:tar_browseoptions." - ") *141 exe "silent r! cat -- ".s:Escape(tarfile)."|gzip -d -c -|".g:tar_cmd." -".g:tar_browseoptions." - " 142 elseif tarfile =~# '\.bz2$' 143 " call Decho("3: exe silent r! bzip2 -d -c ".s:Escape(tarfile)." | ".g:tar_cmd." -".g:tar_browseoptions." - ") *144 exe "silent r! bzip2 -d -c -- ".s:Escape(tarfile)." | ".g:tar_cmd." -".g:tar_browseoptions." - " 145 else 146 " call Decho("4: exe silent r! ".g:tar_cmd." -".g:tar_browseoptions." ".s:Escape(tarfile)) **147 exe "silent r! ".g:tar_cmd." -".g:tar_browseoptions." ".s:Escape(tarfile) [...] 444 fun s:Escape(name) 445 " shellescape() was added by patch 7.0.111 446 if exists("*shellescape") 447 let qnameq= shellescape(a:name) 448 else 449 let qnameq= g:tar_shq . a:name . g:tar_shq 450 endif 451 return qnameq 452 endfun (*) s:Escape() does not suffice, as it fails to escape ``%'' and friends. (**) tar(1) allows arbitrary command execution via options ``--to-command'', and ``--use-compress-program''.