4 ms·
At risk of picking nits, I feel like if the output of a joinPath call is being used somewhere where escapes can be interpreted at all, something that has nothin
by javawizard 3y ago
At risk of picking nits, I feel like if the output of a joinPath call is being used somewhere where escapes can be interpreted at all, something that has nothing to do with your choice of path separator is very wrong.
- flohofwoe 3y agoA common problem is building a command line with paths created with such a Windows-aware joinPath function and then executing that command line. If that execution is handled by a shell instead of going directly through an operating system's CreateProcess() function, then the command line string may be mangled either by the shell, or some other "helpful" code sitting inbetween which tries to resolve backslash-escapes (which are usually needed in front of quotation marks). It a very typical problem in cross-platform Python code, and I think I also stumbled over it in Node.js.
- javawizard 3y agoThat sounds like an RCE waiting to happen. The canonical way to solve this would be to pass the components of that command line through a function that escapes or quotes anything that needs to be escaped. In Ruby and when using bash for example we have [0]. Does Windows have something similar? [0]: https://ruby-doc.org/stdlib-2.5.1/libdoc/shellwords/rdoc/Shellwords.html https://ruby-doc.org/stdlib-2.5.1/libdoc/shellwords/rdoc/She...