DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 5146vZfE1319040
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 30AE13858D20
Message-ID: <864f2d4a-15a2-465b-bf81-6f81ee42e7ea@gmail.com>
Date: Tue, 4 Feb 2025 07:57:07 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Potential Argument Injection Issue in Cygwin's Command Line
 Handling
Content-Language: en-GB
To: cygwin AT cygwin DOT com
References: <CAM2z_YX8cbwea+he+83924SpZAdofp-srLk3Mzof2U4viXgctQ AT mail DOT gmail DOT com>
In-Reply-To: <CAM2z_YX8cbwea+he+83924SpZAdofp-srLk3Mzof2U4viXgctQ@mail.gmail.com>
From: Marco Atzeri via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Marco Atzeri <marco DOT atzeri AT gmail DOT com>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit

On 04/02/2025 07:15, Splitline Huang via Cygwin wrote:
> Hello Cygwin team,
> 
> I am splitline from DEVCORE research team. I recently have observed an
> inconsistency
> in how Cygwin handles command-line parsing compared to Microsoft’s
> implementation.
> 
> 
> According to Microsoft’s documentation [1], the \" sequence should always
> be
> interpreted as a literal double quote ("):
>> A double quote mark preceded by a backslash (\") is interpreted as a
> literal
>> double quote mark (").
> 
> However, in Cygwin, the same sequence treats the backslash as a literal
> character
> and starts quote mode instead.
> 

> $ which python
> 
> /cygdrive/c/Python313/python
> 
> splitline AT SPLITLINE0D06 ~
> 
> $ python
> 
> Python 3.13.1 (tags/v3.13.1:0671451, Dec  3 2024, 19:06:28) [MSC v.1942
> 
> 64 bit (AMD64)] on win32
> 
> Type "help", "copyright", "credits" or "license" for more information.
> 
>>>> import subprocess
> 
>>>> subprocess.run(['./test.exe', '"', " a b c"]) # should be only 2 args
> 
> argv[0] = ./test
> 
> argv[1] = \
> 
> argv[2] = a
> 
> argv[3] = b
> 
> argv[4] = c
> 
> CompletedProcess(args=['./test.exe', '"', ' a b c'], returncode=0)
> 
>>>>
> 
> 
> 
> As we can see, it should originally be only 2 arguments: ["] and [ a b c].
> However,
> the command line is parsed into 4 different arguments.


$ python3.12
  Python 3.12.8 (main, Jan 31 2025, 21:29:51) [GCC 12.4.0] on cygwin
  Type "help", "copyright", "credits" or "license" for more information.
   import subprocess
   subprocess.run(['./test.exe', '"', " a b c"])
  argv[0] = ./test
  argv[1] = "
  argv[2] =  a b c
  CompletedProcess(args=['./test.exe', '"', ' a b c'], returncode=0)

it seems correct to me for a Cygwin Python

> Note: With that Python code, the spawned command line is: ./test.exe \" " a
> b c"
> 
> Please let me know if you have any questions, thanks!
> 
> Best regards,
> splitline
> DEVCORE

Regards
Marco

PS: Windows is not very consistent on quoting behaviour, e.g.
https://github.com/Azure/azure-cli/blob/dev/doc/quoting-issues-with-powershell.md


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple