harden search parsing and qobuz refresh validation

cmd/rip/main.go

@@ -13,6 +13,7 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"regexp"
 	"runtime"
 	"strconv"
@@ -1995,6 +1996,12 @@ func parseSearchArgs(args []string, defaultLimit int) (searchOptions, error) {
 	first := false
 	outputFile := ""
 	for i := 0; i < len(args); i++ {
+		if args[i] == "--" {
+			if i+1 < len(args) {
+				parts = append(parts, args[i+1:]...)
+			}
+			break
+		}
 		switch args[i] {
 		case "--force", "--ignore-db":
 			ignoreDB = true
@@ -2010,6 +2017,9 @@ func parseSearchArgs(args []string, defaultLimit int) (searchOptions, error) {
 				return searchOptions{}, fmt.Errorf("--output-file requires a path")
 			}
 			outputFile = strings.TrimSpace(args[i+1])
+			if outputFile == "" {
+				return searchOptions{}, fmt.Errorf("--output-file requires a non-empty path")
+			}
 			i++
 			continue
 		case "--num-results":
@@ -2036,6 +2046,9 @@ func parseSearchArgs(args []string, defaultLimit int) (searchOptions, error) {
 			i++
 			continue
 		}
+		if strings.HasPrefix(args[i], "-") {
+			return searchOptions{}, fmt.Errorf("unknown option %q", args[i])
+		}
 		parts = append(parts, args[i])
 	}
 	return searchOptions{
@@ -2196,6 +2209,12 @@ func writeSearchResultsToFile(source, mediaType string, results []searchResult,
 	if err != nil {
 		return err
 	}
+	dir := filepath.Dir(path)
+	if dir != "" && dir != "." {
+		if err = os.MkdirAll(dir, 0o755); err != nil {
+			return err
+		}
+	}
 	return os.WriteFile(path, b, 0o644)
 }