That sounds like an RCE waiting to happen. The canonical way to solve this would be to pass the components of that command line through a function that escapes

That sounds like an RCE waiting to happen. The canonical way to solve this would be to pass the components of that command line through a function that escapes or quotes anything that needs to be escaped. In Ruby and when using bash for example we have [0]. Does Windows have something similar? [0]: https://ruby-doc.org/stdlib-2.5.1/libdoc/shellwords/rdoc/Shellwords.html https://ruby-doc.org/stdlib-2.5.1/libdoc/shellwords/rdoc/She...