DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 51B2Ae1p180287
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 00DC33858D20
MIME-Version: 1.0
Date: Mon, 10 Feb 2025 18:09:09 -0800
To: cygwin@cygwin.com
Subject: Re: Potential Argument Injection Issue in Cygwin's Command Line
 Handling
In-Reply-To: <8ac24b73-54e9-470b-9fa8-6da07f3e2d42@SystematicSW.ab.ca>
References: <CAM2z_YX8cbwea+he+83924SpZAdofp-srLk3Mzof2U4viXgctQ@mail.gmail.com>
 <CAM2z_YVYuoq28ZzmZn1RTWdRYLNpGMgjBzRQnKdZ0bb4yTmv=w@mail.gmail.com>
 <Z6ME2gh4Mu4Xz3pY@xps13>
 <CAM2z_YUpN4RFCxxA9cLK=qU-vNqHNP7BTL0iFCM_eRg6Me3JrQ@mail.gmail.com>
 <8ac24b73-54e9-470b-9fa8-6da07f3e2d42@SystematicSW.ab.ca>
User-Agent: Roundcube Webmail/1.4.15
Message-ID: <69f47b2daf1a6a46b0200c31669e1aee@kylheku.com>
Precedence: list
From: Kaz Kylheku via Cygwin <cygwin@cygwin.com>
Reply-To: Kaz Kylheku <kaz@kylheku.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces~archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

On 2025-02-10 12:32, Brian Inglis via Cygwin wrote:
> One can avoid any issues by running Cygwin programs only from other Cygwin programs, and Windows programs only from other Windows programs.

Microsoft has provided a documented algorithm, which is implemented in the ShellAPI function CommandLineToArgvW, and in the CRT module that prepares arguments for the main or wmain functions of Microsoft Visual C/C++ programs.

I believe that the algorithm is sound in that it can round-trip any argv[] vector to string, and then back to recover an identical argv[].

(Am I correct?)

If that is the case, there is no reason why a POSIX layer on Windows would not use that algorithm, since it meets its requirements for passing an argv[] from one process to another, and is compatible with recommendations from the OS vendor, with a reference implementation (for the parsing direction) present in every Windows (ShellAPI).

What I've noticed in Cygwin is that it destroys the command line! When you call GetCommandLineW in a Cygwin process, you get an empty line. I recently posted here about this. That means you cannot ignore the arguments given in main() and just do it yourself.

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple