DMARC-Filter:	OpenDMARC Filter v1.4.2 delorie.com 51B2Ae1p180287
Authentication-Results:	delorie.com; dmarc=pass (p=none dis=none) header.from=cygwin.com
Authentication-Results:	delorie.com; spf=pass smtp.mailfrom=cygwin.com
DKIM-Filter:	OpenDKIM Filter v2.11.0 delorie.com 51B2Ae1p180287
Authentication-Results:	delorie.com;
	dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=qCMXZeKd
X-Recipient:	archive-cygwin AT delorie DOT com
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org E7C4F3858403
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1739239838;
	bh=fwKgH92/dgMSBCG1NSVuMZCcoYXQalyaWCp7tqLnunA=;
	h=Date:To:Subject:In-Reply-To:References:List-Id:List-Unsubscribe:
	List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:
	From;
	b=qCMXZeKdQLQT8Xe4a1MyDFqRHdBoyMciUViLU2DD95NwMhUzNooJzEW2z5Ox1aPz2
	YXXM3emPXV1Bf7LppqgncznpQYa/qD+/W34dHvxkQGx9WYW3KU8+8AGfWWeONn0vch
	q8Nd9Bou8JpJx9gC58RYRgrHMVJyru5aNZBqhAtg=
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.2 sourceware.org 00DC33858D20
ARC-Filter:	OpenARC Filter v1.0.0 sourceware.org 00DC33858D20
ARC-Seal:	i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1739239804; cv=none;
	b=iilkUcvodbveUGHCJsHXoifSgt3syn3S9xvP+/BltKbO2pCCrS5wG9KnTKj2kRdafUexQcd+DdVyVMRHhN2cjWhtNO+oSHol708PwLYVBlNvNJrVBqV7n0jPAHUIjtSCT+AcX0t3QfNCT4xq5yz9ao/rbmNbEJUXxlXhj4joo10=
ARC-Message-Signature:	i=1; a=rsa-sha256; d=sourceware.org; s=key;
	t=1739239804; c=relaxed/simple;
	bh=M3Jt4KC3QdvLN2eoiN/EuBmPTRqqkuKaeKPtOyVrh1Y=;
	h=MIME-Version:Date:From:To:Subject:Message-ID;
	b=aCaXAZNePpkQFiqtNT9CyQPW7C0A3DA+ld7yHOdmngHKa+jjuKBz3cW2FU4K59/5lyTIqlHtE/Cjt+5rzrnAnlULjn6BRyo6JoShAmjXMy15NtxRUBztIdOrDkifXWs4hxCHrMXX2TnPQnQAZB6bA/0EUacEn8IXexLf7XCZZ3Y=
ARC-Authentication-Results:	i=1; server2.sourceware.org
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org 00DC33858D20
MIME-Version:	1.0
Date:	Mon, 10 Feb 2025 18:09:09 -0800
To:	cygwin AT cygwin DOT com
Subject:	Re: Potential Argument Injection Issue in Cygwin's Command Line
	Handling
In-Reply-To:	<8ac24b73-54e9-470b-9fa8-6da07f3e2d42@SystematicSW.ab.ca>
References:	<CAM2z_YX8cbwea+he+83924SpZAdofp-srLk3Mzof2U4viXgctQ AT mail DOT gmail DOT com>
	<CAM2z_YVYuoq28ZzmZn1RTWdRYLNpGMgjBzRQnKdZ0bb4yTmv=w AT mail DOT gmail DOT com>
	<Z6ME2gh4Mu4Xz3pY AT xps13>
	<CAM2z_YUpN4RFCxxA9cLK=qU-vNqHNP7BTL0iFCM_eRg6Me3JrQ AT mail DOT gmail DOT com>
	<8ac24b73-54e9-470b-9fa8-6da07f3e2d42 AT SystematicSW DOT ab DOT ca>
User-Agent:	Roundcube Webmail/1.4.15
Message-ID:	<69f47b2daf1a6a46b0200c31669e1aee@kylheku.com>
X-Sender:	kaz AT kylheku DOT com
X-MagicMail-OS:	Unknown
X-MagicMail-UUID:	4da5da40-e81d-11ef-90bd-00505695d298
X-MagicMail-Authenticated:	fuck DOT telus AT novus DOT ca
X-MagicMail-SourceIP:	104.37.63.7
X-MagicMail-RegexMatch:	1
X-MagicMail-EnvelopeFrom:	<fuck DOT telus AT novus DOT ca>
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.30
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe:	<https://cygwin.com/mailman/options/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From:	Kaz Kylheku via Cygwin <cygwin AT cygwin DOT com>
Reply-To:	Kaz Kylheku <kaz AT kylheku DOT com>
Errors-To:	cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender:	"Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

On 2025-02-10 12:32, Brian Inglis via Cygwin wrote:
> One can avoid any issues by running Cygwin programs only from other Cygwin programs, and Windows programs only from other Windows programs.

Microsoft has provided a documented algorithm, which is implemented in the ShellAPI function CommandLineToArgvW, and in the CRT module that prepares arguments for the main or wmain functions of Microsoft Visual C/C++ programs.

I believe that the algorithm is sound in that it can round-trip any argv[] vector to string, and then back to recover an identical argv[].

(Am I correct?)

If that is the case, there is no reason why a POSIX layer on Windows would not use that algorithm, since it meets its requirements for passing an argv[] from one process to another, and is compatible with recommendations from the OS vendor, with a reference implementation (for the parsing direction) present in every Windows (ShellAPI).

What I've noticed in Cygwin is that it destroys the command line! When you call GetCommandLineW in a Cygwin process, you get an empty line. I recently posted here about this. That means you cannot ignore the arguments given in main() and just do it yourself.

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -