Merge pull request rails#51 from cablegram/master

Ensure that commands and args are properly quoted if they contain spaces or reserved shell characters (on Windows).

lib/execjs/external_runtime.rb

@@ -183,7 +183,10 @@ def sh(command)
       if ExecJS.windows?
         def shell_escape(*args)
           # see http://technet.microsoft.com/en-us/library/cc723564.aspx#XSLTsection123121120120
-          args.map { |arg| arg.gsub(/([&|()<>^ "])/,'^\1') }.join(" ")
+          args.map { |arg|
+            arg = %Q("#{arg.gsub('"','""')}") if arg.match(/[&|()<>^ "]/)
+            arg
+          }.join(" ")
         end
       else
         def shell_escape(*args)