gatsby-plugin-subfont file paths isn't escaped in execSync command

[violy]

Description

In the gatsby-plugin-subfont plugin, file paths aren't escaped in execSync command.
I've get the error locally, in development context, during the build, because the absolute path of my project root contains spaces (Ok, it’s bad.)

Steps to reproduce

1. install gatsby in a directory containing some space in there dirname (or other character to be escaped)
2. install and configure the plugin gatsby-plugin-subfont
3. run gastby build
4. see some warnings at the end of the build like this :

 ⚠ WARN: ENOENT: no such file or directory, open 'after_space/public'
 ⚠ WARN: ENOENT: no such file or directory, open '/Users/arthurvioly/Documents/projects/before_space'
 ⚠ WARN: ENOENT: no such file or directory, open 'after_space/public/index.html'

5. the plugin has no effect on build, no subfont.

Expected result

1. No warning
2. do the plugin job on index.html

Actual result

1. Warnings during build
2. Execution off subfont command failed

Environment

  System:
    OS: macOS 10.14.3
    CPU: (8) x64 Intel(R) Core(TM) i7-4850HQ CPU @ 2.30GHz
    Shell: 3.2.57 - /bin/bash
  Binaries:
    Node: 10.10.0 - /usr/local/bin/node
    Yarn: 1.9.4 - /usr/local/bin/yarn
    npm: 6.9.0 - /usr/local/bin/npm
  Languages:
    Python: 2.7.10 - /usr/bin/python
  Browsers:
    Chrome: 72.0.3626.121
    Firefox: 64.0.2
    Safari: 12.0.3
  npmPackages:
    gatsby: ^2.0.119 => 2.0.119 
    gatsby-image: ^2.0.29 => 2.0.29 
    gatsby-plugin-manifest: ^2.0.17 => 2.0.17 
    gatsby-plugin-offline: ^2.0.25 => 2.0.25 
    gatsby-plugin-react-helmet: ^3.0.6 => 3.0.6 
    gatsby-plugin-sass: ^2.0.10 => 2.0.10 
    gatsby-plugin-sharp: ^2.0.20 => 2.0.20 
    gatsby-plugin-subfont: ^1.0.4 => 1.0.4 
    gatsby-source-filesystem: ^2.0.20 => 2.0.20 
    gatsby-transformer-sharp: ^2.1.13 => 2.1.13 
  npmGlobalPackages:
    gatsby-cli: 2.4.16

[violy]

To fix the problem, I've simply add double quotes " " to wrap the paths.

in node_modules/gatsby-plugin-subfont/gatsby-node.js:14

  const filePaths = urlPaths.reduce((accumulator, currentPath) => `${accumulator} "${path.join(root, currentPath, `index.html`)}"`, ``);
  const command = `node_modules/.bin/subfont -i --no-recursive --inline-css --root "file://${root}"${filePaths}`;

But the path escape resolution is not strict with this simple double quotes fix.
I think using shell-escape package would be a best resolution ?

[violy]

Ok, so, here is my PR !
thank you.

[violy]

I've forget to run yarn lint before my PR !