rsync_get_file, rsync_post_file unsafe with shell metacharacters in filename

rsync_get_file, rsync_post_file do not escape shell metacharacters in remote filenames and do not use rsync -s,
this is easily exploitable security vulnerability when pulsar is used with older rsync version (<3.2.4).
Using rsync -s should fix it.

Start by locating the rsync_get_file and rsync_post_file entry points and inspect how remote filenames are passed to rsync. Reproduce the shell-metacharacter case with an older rsync version, then verify that using rsync -s prevents interpretation of the filename.

Written by the indexing model from the issue text.