Arguments for external executables aren't correctly escaped
See original GitHub issueSteps to reproduce
- write a C program
native.exe
which acquires ARGV - Run
native.exe "`"a`""
Expected behavior
ARGV[1] == "a"
Actual behavior
ARGV[1] == a
Environment data
Windows 10 x64
Name Value
---- -----
PSVersion 5.1.14393.0
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.0
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
Issue Analytics
- State:
- Created 7 years ago
- Reactions:37
- Comments:201 (111 by maintainers)
Top Results From Across the Web
python - How to escape os.system() calls?
Remove all chars that aren't in that list. Escape slashes and double-quotes. Surround entire command with double quotes so the command argument ......
Read more >is there an escape for '&' character in the command prompt?
Since & is a special char, you must escape it with ^ , resulting in ^& . Running set pwd=abc^&123 will set the...
Read more >about Parsing - PowerShell
Numbers are treated as numerical values rather than as a series of characters (unless escaped). Operators, including unary operators like - and ...
Read more >escapeshellarg - Manual
Correctly escaping shell commands on Windows is not a simple matter. Programs must consider two distinct escape mechanisms which serve different purposes:
Read more >escapeshellcmd - Manual
escapeshellcmd() escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands. This function should...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Currently to make
native.exe
correctly receive an ARGV with two quotes and ana
character, you have to use this weird call:Making a special operator for this doesn’t make sense for a command-line shell at all, since its main job is to launch programs and pass them arguments. Introducing a new operator that does
system()
for this job is like Matlab introducing a way to callcalc.exe
because it has a bug in its arithmetics. What should instead be done is that:The same applies to
Start-Process
. (Actually it’s a pretty good candidate for the “new” cmdlet with some options like-QuotingBehavior Legacy
…) See #13089.