From 6befacbba2a9025b86c2c7a903a9538b32ad9236 Mon Sep 17 00:00:00 2001
From: Pascal Christoph <christoph@hbz-nrw.de>
Date: Tue, 27 Aug 2024 11:46:00 +0200
Subject: [PATCH] Use quotation marks in variable

Prevents possible remote code execution.
Thx @blackwinter.
---
 scripts/generateRvkConcordance.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/generateRvkConcordance.sh b/scripts/generateRvkConcordance.sh
index 62848d5fa..a4afe86f4 100644
--- a/scripts/generateRvkConcordance.sh
+++ b/scripts/generateRvkConcordance.sh
@@ -10,8 +10,8 @@ URL_ROOT="https://data.dnb.de/culturegraph/"
 TARGET_FNAME="/data/other/cg/aggregate.marcxml.gz"
 
 FNAME=$(curl $URL_ROOT | grep '<a href="aggregate_' | sed 's#.*\<a href="aggregate_\(.*\)".*#aggregate_\1#g')
-echo "Got filename: $FNAME"
-wget $URL_ROOT$FNAME -O $TARGET_FNAME
+echo Got filename: "$FNAME"
+wget "$URL_ROOT$FNAME" -O $TARGET_FNAME
 
 FNAME_SIZE=$(ls -s $TARGET_FNAME |cut -d ' ' -f1)
 if [ $FNAME_SIZE -gt 8654321 ]; then # 9593288 blocks was aggregate_20240507.marcxml.gz