diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/command/CheckoutCommand.java b/src/main/java/com/googlesource/gerrit/plugins/download/command/CheckoutCommand.java
index 8f66485..32ebb3d 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/command/CheckoutCommand.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/command/CheckoutCommand.java
@@ -33,6 +33,6 @@
 
   @Override
   String getCommand(String url, String ref) {
-    return "git fetch " + url + " " + ref + " && git checkout FETCH_HEAD";
+    return "git fetch " + QuoteUtil.quote(url) + " " + ref + " && git checkout FETCH_HEAD";
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/command/CherryPickCommand.java b/src/main/java/com/googlesource/gerrit/plugins/download/command/CherryPickCommand.java
index 670af42..3aea2ee 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/command/CherryPickCommand.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/command/CherryPickCommand.java
@@ -33,6 +33,6 @@
 
   @Override
   String getCommand(String url, String ref) {
-    return "git fetch " + url + " " + ref + " && git cherry-pick FETCH_HEAD";
+    return "git fetch " + QuoteUtil.quote(url) + " " + ref + " && git cherry-pick FETCH_HEAD";
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/command/CloneCommand.java b/src/main/java/com/googlesource/gerrit/plugins/download/command/CloneCommand.java
index dac10f5..ca9ebc8 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/command/CloneCommand.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/command/CloneCommand.java
@@ -20,6 +20,6 @@
 
   @Override
   public String getCommand(DownloadScheme scheme, String project) {
-    return "git clone " + scheme.getUrl(project);
+    return "git clone " + QuoteUtil.quote(scheme.getUrl(project));
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/command/CloneWithCommitMsgHook.java b/src/main/java/com/googlesource/gerrit/plugins/download/command/CloneWithCommitMsgHook.java
index 087ef50..d55a2ed 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/command/CloneWithCommitMsgHook.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/command/CloneWithCommitMsgHook.java
@@ -55,7 +55,7 @@
       return new StringBuilder()
           .append(super.getCommand(scheme, project))
           .append(" && (cd ")
-          .append(projectName)
+          .append(QuoteUtil.quote((projectName)))
           .append(" && ")
           .append(configCommand)
           .append(")")
@@ -77,11 +77,9 @@
           .append(":")
           .append(HOOK)
           .append(" ")
-          .append(projectName)
-          .append("/.git/hooks/");
-
+          .append(QuoteUtil.quote(projectName + "/.git/hooks/"));
       if (extraCommand != null) {
-        b.append(" && (cd ").append(projectName).append(" && ").append(extraCommand).append(")");
+        b.append(" && (cd ").append(QuoteUtil.quote(projectName)).append(" && ").append(extraCommand).append(")");
       }
       return b.toString();
     }
@@ -90,7 +88,7 @@
       return new StringBuilder()
           .append(super.getCommand(scheme, project))
           .append(" && (cd ")
-          .append(projectName)
+          .append(QuoteUtil.quote(projectName))
           .append(" && mkdir -p .git/hooks")
           .append(" && curl -Lo")
           .append(TARGET)
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/command/FormatPatchCommand.java b/src/main/java/com/googlesource/gerrit/plugins/download/command/FormatPatchCommand.java
index 9ca69ce..a65b5e1 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/command/FormatPatchCommand.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/command/FormatPatchCommand.java
@@ -33,6 +33,10 @@
 
   @Override
   String getCommand(String url, String ref) {
-    return "git fetch " + url + " " + ref + " && git format-patch -1 --stdout FETCH_HEAD";
+    return "git fetch "
+        + QuoteUtil.quote(url)
+        + " "
+        + ref
+        + " && git format-patch -1 --stdout FETCH_HEAD";
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/command/PullCommand.java b/src/main/java/com/googlesource/gerrit/plugins/download/command/PullCommand.java
index 5544925..d93f6b6 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/command/PullCommand.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/command/PullCommand.java
@@ -33,6 +33,6 @@
 
   @Override
   String getCommand(String url, String ref) {
-    return "git pull " + url + " " + ref;
+    return "git pull " + QuoteUtil.quote(url) + " " + ref;
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/command/QuoteUtil.java b/src/main/java/com/googlesource/gerrit/plugins/download/command/QuoteUtil.java
new file mode 100644
index 0000000..e3c73f8
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/command/QuoteUtil.java
@@ -0,0 +1,24 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.download.command;
+
+public class QuoteUtil {
+
+  private QuoteUtil() {}
+
+  public static String quote(String string) {
+    return "\"" + string + "\"";
+  }
+}
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/command/RepoCommand.java b/src/main/java/com/googlesource/gerrit/plugins/download/command/RepoCommand.java
index 4322f76..b0abf9c 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/command/RepoCommand.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/command/RepoCommand.java
@@ -25,7 +25,7 @@
     if (scheme instanceof RepoScheme) {
       String id = trim(ref);
       if (id != null) {
-        return "repo download " + scheme.getUrl(project) + " " + id;
+        return "repo download " + QuoteUtil.quote(scheme.getUrl(project)) + " " + id;
       }
     }
     return null;