Vuln: Arbitrary command execution in package downloading

[xslendix]

Here: https://github.com/statulr/aurc/blob/main/src/aurc_aur.c#L53 if the package name is something like this: &&funny_stuff this can be very easily be used for code execution.

This could be fixed in two ways:

1. Using the libcurl instead of system
2. Making sure the name is good by checking something like [a-Z0-9_-]+

[statulr]

Working on now

[statulr]

Solved @xslendix