@lde/sparql-qlever 0.14.4 → 0.14.5

package/dist/importer.js

@@ -168,12 +168,26 @@ export class Importer {
         const metadataFile = `${this.options.indexName}.meta-data.json`;
         const localName = basename(file);
         const decompressCommand = localName.toLowerCase().endsWith('.zip')
-            ? `unzip -p '${localName}'`
-            : `(gunzip -c '${localName}' 2>/dev/null || cat '${localName}')`;
-        const indexTask = await this.options.taskRunner.run(`${decompressCommand} | qlever-index ${flags} && cat ${metadataFile}`);
+            ? `unzip -p ${shellQuote(localName)}`
+            : `(gunzip -c ${shellQuote(localName)} 2>/dev/null || cat ${shellQuote(localName)})`;
+        const indexTask = await this.options.taskRunner.run(`${decompressCommand} | qlever-index ${flags} && cat ${shellQuote(metadataFile)}`);
         return await this.options.taskRunner.wait(indexTask);
     }
 }
+/**
+ * POSIX-quote a value for safe interpolation into a shell command: wrap it in
+ * single quotes and escape any embedded single quote as `'\''`.
+ *
+ * Without this, a data filename containing an apostrophe — e.g. a dataset
+ * titled `'s-Hertogenbosch`, whose distribution URL maps to a local file like
+ * `…Erfgoed+'s-Hertogenbosch.nt` — would terminate the surrounding quotes, so
+ * `cat`/`gunzip` would read a non-existent path and feed `qlever-index` empty
+ * input. The index then "succeeds" with 0 triples, the import is treated as
+ * failed, and every distribution (and the JSON-LD fallback) fails the same way.
+ */
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
 /**
  * Native QLever index formats — `qlever-index -F <flag>` consumes these
  * directly. JSON-LD is not here: it is preprocessed to N-Quads first (see

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lde/sparql-qlever",
-  "version": "0.14.4",
+  "version": "0.14.5",
   "repository": {
     "url": "git+https://github.com/ldelements/lde.git",
     "directory": "packages/sparql-qlever"
@@ -35,7 +35,7 @@
     "rdf-parse": "^5.0.0",
     "rdf-serialize": "^5.1.0",
     "tslib": "^2.3.0",
-    "yauzl": "^3.2.0"
+    "yauzl": "^3.3.1"
   },
   "devDependencies": {
     "@rdfjs/types": "^2.0.0",