From f59b6bef4a527b7998e76592e648dd25eb2358c9 Mon Sep 17 00:00:00 2001
From: Luca Succi <luca.succi@stritzinger.com>
Date: Thu, 19 Feb 2026 14:12:15 +0100
Subject: [PATCH] Quote input paths passed to tar command

---
 src/grisp_tools_firmware.erl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/grisp_tools_firmware.erl b/src/grisp_tools_firmware.erl
index fa1098c..9f70945 100644
--- a/src/grisp_tools_firmware.erl
+++ b/src/grisp_tools_firmware.erl
@@ -370,7 +370,7 @@ deploy_bundle(State = #{edifa_pid := Pid, bundle := BundleFile}, PartId) ->
         {error, Reason, State2} ->
             event(State2, [{error, Reason}]);
         {ok, MountPoint, State2} ->
-            ExpandCmd = ["tar -C ", MountPoint, " -xzf ", BundleFile],
+            ExpandCmd = ["tar -C '", MountPoint, "' -xzf '", BundleFile, "'"],
             {{ok, _}, State3} = shell(State2, ExpandCmd),
             Opts2 = edifa_opts(State2),
             case edifa:unmount(Pid, PartId, Opts2) of