From d1a071d403660d7cdaf0db0569ec72b690c76181 Mon Sep 17 00:00:00 2001
From: Seth Vargo <sethvargo@gmail.com>
Date: Sat, 25 Jun 2016 15:23:28 -0400
Subject: [PATCH] guests/darwin: Shellescape guest path for rsync

---
 plugins/guests/darwin/cap/rsync.rb | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/plugins/guests/darwin/cap/rsync.rb b/plugins/guests/darwin/cap/rsync.rb
index 7e5d6d9a5..e1c594a19 100644
--- a/plugins/guests/darwin/cap/rsync.rb
+++ b/plugins/guests/darwin/cap/rsync.rb
@@ -1,3 +1,5 @@
+require "shellwords"
+
 module VagrantPlugins
   module GuestDarwin
     module Cap
@@ -11,9 +13,8 @@ module VagrantPlugins
         end
 
         def self.rsync_pre(machine, opts)
-          machine.communicate.tap do |comm|
-            comm.sudo("mkdir -p '#{opts[:guestpath]}'")
-          end
+          guest_path = Shellwords.escape(opts[:guestpath])
+          machine.communicate.sudo("mkdir -p #{guest_path}")
         end
 
         def self.rsync_post(machine, opts)
@@ -21,8 +22,10 @@ module VagrantPlugins
             return
           end
 
+          guest_path = Shellwords.escape(opts[:guestpath])
+
           machine.communicate.sudo(
-            "find '#{opts[:guestpath]}' '(' ! -user #{opts[:owner]} -or ! -group #{opts[:group]} ')' -print0 | " +
+            "find #{guest_path} '(' ! -user #{opts[:owner]} -or ! -group #{opts[:group]} ')' -print0 | " +
             "xargs -0 chown #{opts[:owner]}:#{opts[:group]}")
         end
       end