Escape the path arguments

Author: sebastianfeldmann

src/ComposerPlugin.php

@@ -172,8 +172,8 @@ private function runCaptainCommand(string $command): void
         $interaction = $this->io->isInteractive() ? '' : ' --no-interaction';
 
         // captainhook config and repository settings
-        $configuration  = ' -c ' . $this->configuration;
-        $repository     = $command === self::COMMAND_INSTALL ? ' -g ' . $this->gitDirectory : '';
+        $configuration  = ' -c ' . escapeshellarg($this->configuration);
+        $repository     = $command === self::COMMAND_INSTALL ? ' -g ' . escapeshellarg($this->gitDirectory) : '';
         $skip           = $command === self::COMMAND_INSTALL ? ' -s' : '';
 
         // sub process settings