Re: Potential Argument Injection Issue in Cygwin's Command Line Handling

2025-02-04 Thread Splitline Ng via Cygwin
Hi Marco, > $ python3.12 > Python 3.12.8 (main, Jan 31 2025, 21:29:51) [GCC 12.4.0] on cygwin > Type "help", "copyright", "credits" or "license" for more information. > import subprocess > subprocess.run(['./test.exe', '"', " a b c"]) > argv[0] = ./test > argv[1] = " > argv[2] = a b c >

Re: Potential Argument Injection Issue in Cygwin's Command Line Handling

2025-02-09 Thread Splitline Ng via Cygwin
> Windows is security deficient in this area, not Cygwin. > > I'll quote myself to share my opinion: > https://git.lighttpd.net/lighttpd/lighttpd1.4/src/branch/master/src/fdevent_win32.c#L543 > * The Microsoft CreateProcess() interface is criminally broken. > * Forcing argument strings to