From ffe7d63e626cd0aac6bf66df8b0bc5a724f7f470 Mon Sep 17 00:00:00 2001
From: Steve Breker <sbreker@artefactual.com>
Date: Tue, 30 Jun 2026 17:22:17 -0700
Subject: [PATCH] Refactor finding aid generation commands

---
 lib/QubitFindingAidGenerator.class.php | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/QubitFindingAidGenerator.class.php b/lib/QubitFindingAidGenerator.class.php
index 7179f755a5..918a8badbf 100644
--- a/lib/QubitFindingAidGenerator.class.php
+++ b/lib/QubitFindingAidGenerator.class.php
@@ -441,13 +441,12 @@ public function generateXslFoFile(string $eadFilePath): string
         $foFilePath = tempnam(sys_get_temp_dir(), 'ATM');
 
         $cmd = sprintf(
-            "java -cp '%s:%s' net.sf.saxon.Transform -s:'%s' -xsl:'%s' -o:'%s' -catalog:'%s' 2>&1",
-            $this->getSaxonPath(),
-            $this->getResolverPath(),
-            $eadFilePath,
-            $xslTmpPath,
-            $foFilePath,
-            $this->getCatalogPath(),
+            'java -cp %s net.sf.saxon.Transform -s:%s -xsl:%s -o:%s -catalog:%s 2>&1',
+            escapeshellarg($this->getSaxonPath().PATH_SEPARATOR.$this->getResolverPath()),
+            escapeshellarg($eadFilePath),
+            escapeshellarg($xslTmpPath),
+            escapeshellarg($foFilePath),
+            escapeshellarg($this->getCatalogPath()),
         );
 
         $this->logger->info(sprintf('Running: %s', $cmd));
@@ -513,9 +512,10 @@ public function generateFindingAid(string $foFilePath): string
 
         // Use FO file generated in previous step to generate finding aid
         $cmd = sprintf(
-            "fop -r -q -a -fo '%s' -%s '%s' 2>&1",
-            $foFilePath, $this->getFormat(),
-            $findingAidPath
+            'fop -r -q -a -fo %s -%s %s 2>&1',
+            escapeshellarg($foFilePath),
+            $this->getFormat(),
+            escapeshellarg($findingAidPath)
         );
 
         $this->logger->info(sprintf('Running: %s', $cmd));