Don't allow special characters in sandbox rule paths

Library/Homebrew/sandbox.rb

@@ -231,17 +231,14 @@ def exec(*args)
     end
   end
 
-  private
-
-  sig { params(path: Pathname).returns(Pathname) }
-  def expand_realpath(path)
-    raise unless path.absolute?
-
-    path.exist? ? path.realpath : expand_realpath(path.parent)/path.basename
-  end
-
+  # @api private
   sig { params(path: T.any(String, Pathname), type: Symbol).returns(String) }
   def path_filter(path, type)
+    invalid_char = ['"', "'", "(", ")", "\n"].find do |c|
+      path.to_s.include?(c)
+    end
+    raise ArgumentError, "Invalid character #{invalid_char} in path: #{path}" if invalid_char
+
     case type
     when :regex   then "regex #\"#{path}\""
     when :subpath then "subpath \"#{expand_realpath(Pathname.new(path))}\""
@@ -250,6 +247,15 @@ def path_filter(path, type)
     end
   end
 
+  private
+
+  sig { params(path: Pathname).returns(Pathname) }
+  def expand_realpath(path)
+    raise unless path.absolute?
+
+    path.exist? ? path.realpath : expand_realpath(path.parent)/path.basename
+  end
+
   class SandboxRule
     sig { returns(T::Boolean) }
     attr_reader :allow

Library/Homebrew/test/sandbox_spec.rb

@@ -21,6 +21,50 @@
     expect(file).to exist
   end
 
+  describe "#path_filter" do
+    ["'", '"', "(", ")", "\n"].each do |char|
+      it "fails if the path contains #{char}" do
+        expect do
+          sandbox.path_filter("foo#{char}bar", :subpath)
+        end.to raise_error(ArgumentError)
+      end
+    end
+  end
+
+  describe "#allow_write_cellar" do
+    it "fails when the formula has a name including )" do
+      f = formula do
+        url "https://brew.sh/foo-1.0.tar.gz"
+        version "1.0"
+
+        def initialize(*, **)
+          super
+          @name = "foo)bar"
+        end
+      end
+
+      expect do
+        sandbox.allow_write_cellar f
+      end.to raise_error(ArgumentError)
+    end
+
+    it "fails when the formula has a name including \"" do
+      f = formula do
+        url "https://brew.sh/foo-1.0.tar.gz"
+        version "1.0"
+
+        def initialize(*, **)
+          super
+          @name = "foo\"bar"
+        end
+      end
+
+      expect do
+        sandbox.allow_write_cellar f
+      end.to raise_error(ArgumentError)
+    end
+  end
+
   describe "#exec" do
     it "fails when writing to file not specified with ##allow_write" do
       expect do