Added sanitisation of the only user controllable parameter and removed use of shell in subprocess.popen to

improve security and reduce breakage risk from ugly filenames pointed out by A Nonymous in
https://bitbucket.org/galaxy/galaxy-central/issue/793/rgenetics-rgfastqcpy-tool-does-not-escape

tools/rgenetics/rgFastQC.py

@@ -13,8 +13,13 @@ Author notified...
 
 
 """
-
-import os,sys,subprocess,optparse,shutil,tempfile
+import re
+import os
+import sys
+import subprocess
+import optparse
+import shutil
+import tempfile
 from rgutils import getFileString
 
 class FastQC():
@@ -38,25 +43,26 @@ class FastQC():
 
         """
         serr = ''
-        dummy,tlog = tempfile.mkstemp(prefix='rgFastQClog')
+        dummy,tlog = tempfile.mkstemp(prefix='rgFastQC',suffix=".log",dir=self.opts.outputdir)
         sout = open(tlog, 'w')
         fastq = os.path.basename(self.opts.input)
-        cl = [self.opts.executable,'-o %s' % self.opts.outputdir]
+        cl = [self.opts.executable,'--outdir=%s' % self.opts.outputdir]
         if self.opts.informat in ['sam','bam']:
             cl.append('-f %s' % self.opts.informat)
         if self.opts.contaminants <> None :
             cl.append('-c %s' % self.opts.contaminants)
         # patch suggested by bwlang https://bitbucket.org/galaxy/galaxy-central/pull-request/30
 	# use a symlink in a temporary directory so that the FastQC report reflects the history input file name
-        fastqinfilename = os.path.basename(self.opts.inputfilename).replace(' ','_')
+        fastqinfilename = re.sub('[^a-zA-Z0-9_]+', '', os.path.basename(self.opts.inputfilename))
         link_name = os.path.join(self.opts.outputdir, fastqinfilename)
         os.symlink(self.opts.input, link_name)
         cl.append(link_name)        
-        p = subprocess.Popen(' '.join(cl), shell=True, stderr=sout, stdout=sout, cwd=self.opts.outputdir)
+        sout.write('# FastQC cl = %s\n' % ' '.join(cl))
+        sout.flush()
+        p = subprocess.Popen(cl, shell=False, stderr=sout, stdout=sout, cwd=self.opts.outputdir)
         retval = p.wait()
         sout.close()
         runlog = open(tlog,'r').readlines()
-        os.unlink(tlog)
         os.unlink(link_name)
         flist = os.listdir(self.opts.outputdir) # fastqc plays games with its output directory name. eesh
         odpath = None

tools/rgenetics/rgFastQC.xml

@@ -1,5 +1,5 @@
-<tool name="Fastqc: Fastqc QC" id="fastqc" version="0.5">
-  <description>using FastQC from Babraham</description>
+<tool name="FastQC:Read QC" id="fastqc" version="0.51">
+  <description>reports using FastQC</description>
   <command interpreter="python">
     rgFastQC.py -i "$input_file" -d "$html_file.files_path" -o "$html_file" -n "$out_prefix" -f "$input_file.ext" -j "$input_file.name" -e "${GALAXY_DATA_INDEX_DIR}/shared/jars/FastQC/fastqc"
 #if $contaminants.dataset and str($contaminants) > ''
@@ -21,7 +21,7 @@
            help="tab delimited file with 2 columns: name and sequence.  For example: Illumina Small RNA RT Primer	CAAGCAGAAGACGGCATACGA"/>
   </inputs>
   <outputs>
-    <data format="html" name="html_file"  label="${out_prefix}_${on_string}.html" />
+    <data format="html" name="html_file"  label="${out_prefix}_${input_file.name}.html" />
   </outputs>
   <tests>
     <test>
@@ -51,15 +51,18 @@ The main functions of FastQC are:
 - Export of results to an HTML based permanent report
 - Offline operation to allow automated generation of reports without running the interactive application
 
-**FastQC documentation**
 
-This is a Galaxy interface to the external package FastQC_.
-Specific documentation on FastQC can be found on that site.
+-----
+
+
+.. class:: infomark
+
+**FastQC**
+
+This is a Galaxy wrapper. It merely exposes the external package FastQC_ which is documented at FastQC_
+Kindly acknowledge it as well as this tool if you use it.
 FastQC incorporates the Picard-tools_ libraries for sam/bam processing.
 
- .. _FastQC: http://www.bioinformatics.bbsrc.ac.uk/projects/fastqc/
- .. _Picard-tools: http://picard.sourceforge.net/index.shtml
-
 The contaminants file parameter was borrowed from the independently developed
 fastqcwrapper contributed to the Galaxy Community Tool Shed by J. Johnson.
 
@@ -69,7 +72,10 @@ fastqcwrapper contributed to the Galaxy Community Tool Shed by J. Johnson.
 
 **Inputs and outputs**
 
-This wrapper will accept any fastq file as well as sam or bam as the primary file to check.
+FastQC_ is the best place to look for documentation - it's very good. 
+A summary follows below for those in a tearing hurry.
+
+This wrapper will accept a Galaxy fastq, sam or bam as the input read file to check.
 It will also take an optional file containing a list of contaminants information, in the form of
 a tab-delimited file with 2 columns, name and sequence.
 
@@ -88,6 +94,8 @@ The tool produces a single HTML output file that contains all of the results, in
 - Kmer Content
 
 All except Basic Statistics and Overrepresented sequences are plots.
+ .. _FastQC: http://www.bioinformatics.bbsrc.ac.uk/projects/fastqc/
+ .. _Picard-tools: http://picard.sourceforge.net/index.shtml
 
 </help>
 </tool>