Be shell-safe with git-filter-branch use in update.py

third_party/crashpad/update.py

 #!/usr/bin/env python
 # coding: utf-8
 
 # Copyright 2015 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import argparse
 import os
+import pipes
 import re
 import subprocess
 import sys
 import tempfile
 import textwrap
 
 
 IS_WINDOWS = sys.platform.startswith('win')
 
 
@@ skipping 104 matching lines @@
     # missing. This points UPDATE_TO to the rewritten (filtered) version.
     # git-filter-branch insists on running from the top level of the working
     # tree.
     toplevel = subprocess.check_output(['git', 'rev-parse', '--show-toplevel'],
                                        shell=IS_WINDOWS).rstrip()
     subprocess.check_call(
         ['git',
          'filter-branch',
          '--force',
          '--index-filter',
-         'git rm --cached --ignore-unmatch ' + ' '.join(parsed.exclude),
+         'git rm --cached --ignore-unmatch ' +
+             ' '.join(pipes.quote(path) for path in parsed.exclude),
          revision_old + '..UPDATE_TO'],
         cwd=toplevel,
         shell=IS_WINDOWS)
 
     # git-filter-branch saved a copy of the original UPDATE_TO at
     # original/UPDATE_TO, but this isn’t useful because it refers to the same
     # thing as parsed.update_to, which is already known.
     subprocess.check_call(
         ['git', 'update-ref', '-d', 'refs/original/UPDATE_TO'],
         shell=IS_WINDOWS)
@@ skipping 137 matching lines @@
     if has_local_modifications:
         print >>sys.stderr, (
             'Remember to check the Local Modifications section in ' +
             readme_path)
 
     return 0
 
 
 if __name__ == '__main__':
     sys.exit(main(sys.argv[1:]))