DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 51B2Ae1p180287 Authentication-Results: delorie.com; dmarc=pass (p=none dis=none) header.from=cygwin.com Authentication-Results: delorie.com; spf=pass smtp.mailfrom=cygwin.com DKIM-Filter: OpenDKIM Filter v2.11.0 delorie.com 51B2Ae1p180287 Authentication-Results: delorie.com; dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=qCMXZeKd X-Recipient: archive-cygwin AT delorie DOT com DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E7C4F3858403 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com; s=default; t=1739239838; bh=fwKgH92/dgMSBCG1NSVuMZCcoYXQalyaWCp7tqLnunA=; h=Date:To:Subject:In-Reply-To:References:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=qCMXZeKdQLQT8Xe4a1MyDFqRHdBoyMciUViLU2DD95NwMhUzNooJzEW2z5Ox1aPz2 YXXM3emPXV1Bf7LppqgncznpQYa/qD+/W34dHvxkQGx9WYW3KU8+8AGfWWeONn0vch q8Nd9Bou8JpJx9gC58RYRgrHMVJyru5aNZBqhAtg= X-Original-To: cygwin AT cygwin DOT com Delivered-To: cygwin AT cygwin DOT com DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 00DC33858D20 ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 00DC33858D20 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1739239804; cv=none; b=iilkUcvodbveUGHCJsHXoifSgt3syn3S9xvP+/BltKbO2pCCrS5wG9KnTKj2kRdafUexQcd+DdVyVMRHhN2cjWhtNO+oSHol708PwLYVBlNvNJrVBqV7n0jPAHUIjtSCT+AcX0t3QfNCT4xq5yz9ao/rbmNbEJUXxlXhj4joo10= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1739239804; c=relaxed/simple; bh=M3Jt4KC3QdvLN2eoiN/EuBmPTRqqkuKaeKPtOyVrh1Y=; h=MIME-Version:Date:From:To:Subject:Message-ID; b=aCaXAZNePpkQFiqtNT9CyQPW7C0A3DA+ld7yHOdmngHKa+jjuKBz3cW2FU4K59/5lyTIqlHtE/Cjt+5rzrnAnlULjn6BRyo6JoShAmjXMy15NtxRUBztIdOrDkifXWs4hxCHrMXX2TnPQnQAZB6bA/0EUacEn8IXexLf7XCZZ3Y= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 00DC33858D20 MIME-Version: 1.0 Date: Mon, 10 Feb 2025 18:09:09 -0800 To: cygwin AT cygwin DOT com Subject: Re: Potential Argument Injection Issue in Cygwin's Command Line Handling In-Reply-To: <8ac24b73-54e9-470b-9fa8-6da07f3e2d42@SystematicSW.ab.ca> References: <8ac24b73-54e9-470b-9fa8-6da07f3e2d42 AT SystematicSW DOT ab DOT ca> User-Agent: Roundcube Webmail/1.4.15 Message-ID: <69f47b2daf1a6a46b0200c31669e1aee@kylheku.com> X-Sender: kaz AT kylheku DOT com X-MagicMail-OS: Unknown X-MagicMail-UUID: 4da5da40-e81d-11ef-90bd-00505695d298 X-MagicMail-Authenticated: fuck DOT telus AT novus DOT ca X-MagicMail-SourceIP: 104.37.63.7 X-MagicMail-RegexMatch: 1 X-MagicMail-EnvelopeFrom: X-BeenThere: cygwin AT cygwin DOT com X-Mailman-Version: 2.1.30 Precedence: list List-Id: General Cygwin discussions and problem reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Kaz Kylheku via Cygwin Reply-To: Kaz Kylheku Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com Sender: "Cygwin" On 2025-02-10 12:32, Brian Inglis via Cygwin wrote: > One can avoid any issues by running Cygwin programs only from other Cygwin programs, and Windows programs only from other Windows programs. Microsoft has provided a documented algorithm, which is implemented in the ShellAPI function CommandLineToArgvW, and in the CRT module that prepares arguments for the main or wmain functions of Microsoft Visual C/C++ programs. I believe that the algorithm is sound in that it can round-trip any argv[] vector to string, and then back to recover an identical argv[]. (Am I correct?) If that is the case, there is no reason why a POSIX layer on Windows would not use that algorithm, since it meets its requirements for passing an argv[] from one process to another, and is compatible with recommendations from the OS vendor, with a reference implementation (for the parsing direction) present in every Windows (ShellAPI). What I've noticed in Cygwin is that it destroys the command line! When you call GetCommandLineW in a Cygwin process, you get an empty line. I recently posted here about this. That means you cannot ignore the arguments given in main() and just do it yourself. -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple