4 ms·

Hard disagree. The way Windows handles command line parameters is bonkers. It is one string and every program has to escape/parse it themselve. Yes, there is Co

by panzi 2y ago

Hard disagree. The way Windows handles command line parameters is bonkers. It is one string and every program has to escape/parse it themselve. Yes, there is CommandLineToArgvW(), but there is no inverse of this. You need to escape the arguments per hand and can't be sure the program will really interpret them the way you've intended. Even different programs written by Microsoft have different interpretations. See the somewhat recent troubles in Rust: https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh https://github.com/rust-lang/rust/security/advisories/GHSA-q...

chasil 2y ago
As I understand it, CMD.EXE came from OS/2 and has had many revisions that allow more pervasive evaluation of variables (originally, they were expanded only once, at the beginning of a script). The .BAT/.CMD to build the Windows kernel must have originally been quite the kludge. Including pdksh in the original Windows NT might have been a better move. https://blog.nullspace.io/batch.html https://blog.nullspace.io/batch.html
- pmontra 2y ago
  I quote URLs and "file names" with double quotes in Linux bash much like I quote "Program Files" in Windows cmd. It's the same. I quote spaces\ with\ a\ backslash\ sometimes.
andrewla 2y ago
Question of where the pain goes, I guess. In unix, having to deal with shell escaping when doing routine tasks is super annoying -- URLs with question marks and ampersands screwing everything up, and simple expansions (like the `cp *` example above) causing confusing. Yes, Windows resolution and glob expansion can be inconsistent, but it usually isn't, but Unix makes you eat the cruft every time you use it. And you still get tools like ImageMagick that have strange ad hoc syntax for wildcard because they can't use the standard wildcarding, or even ancient tools like find that force you to do all sorts of stupid shit to be compatible with globbing.
rwmj 2y ago
I had to write something to deal with quoting Windows _spawnvp and it's insane: https://gitlab.com/nbdkit/nbdkit/-/blob/0b4a47b5430f8b757f51457aca5b37123eae5217/wrapper.c#L141 https://gitlab.com/nbdkit/nbdkit/-/blob/0b4a47b5430f8b757f51...
pcwalton 2y ago
It's really strange to me that Microsoft has never added an ArgvToCommandLineW(). This would solve most of the problems with Windows command line parsing.
- pjmlp 2y ago
  It was common in MS-DOS compilers, in Windows largely ignored, because GUI is the main way of using the system, not always being stuck in CLI world.
  - panzi 2y ago
    You still need to e.g. pass file paths to a program to open that file in that program.
    - pjmlp 2y ago
      Which can be achieved in various ways in modern OS IPC, not only command line.
SkiFire13 2y ago
> See the somewhat recent troubles in Rust: https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh https://github.com/rust-lang/rust/security/advisories/GHSA-q... FYI this started out as a vulnerability in yt-dlp [1]. Later it was found to impact many other languages [2]. Rust, along with other languages, also considered it a vulnerability to fix, while some other languages only updated the documentation or considered it as wontfix. [1]: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42... [2]: https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ https://flatt.tech/research/posts/batbadbut-you-cant-securel...
panzi 2y ago
PS: Somewhat related, look at the bonkers way Windows resolves the program to execute from the command line string: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw#parameters https://learn.microsoft.com/en-us/windows/win32/api/processt... PPS: Even less related, there's no exec() in Win32, so you can't write a starter program that does some setup and then runs another program (e.g. specified as a parameter). You need to keep the starter program open and act as a proxy to the started program! See the various dotenv CLI implementations. But I digress.

by panzi 2y ago

chasil 2y ago

As I understand it, CMD.EXE came from OS/2 and has had many revisions that allow more pervasive evaluation of variables (originally, they were expanded only once, at the beginning of a script). The .BAT/.CMD to build the Windows kernel must have originally been quite the kludge. Including pdksh in the original Windows NT might have been a better move. https://blog.nullspace.io/batch.html https://blog.nullspace.io/batch.html

pmontra 2y ago
I quote URLs and "file names" with double quotes in Linux bash much like I quote "Program Files" in Windows cmd. It's the same. I quote spaces\ with\ a\ backslash\ sometimes.

andrewla 2y ago

Question of where the pain goes, I guess. In unix, having to deal with shell escaping when doing routine tasks is super annoying -- URLs with question marks and ampersands screwing everything up, and simple expansions (like the `cp *` example above) causing confusing. Yes, Windows resolution and glob expansion can be inconsistent, but it usually isn't, but Unix makes you eat the cruft every time you use it. And you still get tools like ImageMagick that have strange ad hoc syntax for wildcard because they can't use the standard wildcarding, or even ancient tools like find that force you to do all sorts of stupid shit to be compatible with globbing.

rwmj 2y ago

I had to write something to deal with quoting Windows _spawnvp and it's insane: https://gitlab.com/nbdkit/nbdkit/-/blob/0b4a47b5430f8b757f51457aca5b37123eae5217/wrapper.c#L141 https://gitlab.com/nbdkit/nbdkit/-/blob/0b4a47b5430f8b757f51...

pcwalton 2y ago

It's really strange to me that Microsoft has never added an ArgvToCommandLineW(). This would solve most of the problems with Windows command line parsing.

pjmlp 2y ago
It was common in MS-DOS compilers, in Windows largely ignored, because GUI is the main way of using the system, not always being stuck in CLI world.
- panzi 2y ago
  You still need to e.g. pass file paths to a program to open that file in that program.
  - pjmlp 2y ago
    Which can be achieved in various ways in modern OS IPC, not only command line.

SkiFire13 2y ago

> See the somewhat recent troubles in Rust: https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh https://github.com/rust-lang/rust/security/advisories/GHSA-q... FYI this started out as a vulnerability in yt-dlp [1]. Later it was found to impact many other languages [2]. Rust, along with other languages, also considered it a vulnerability to fix, while some other languages only updated the documentation or considered it as wontfix. [1]: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42... [2]: https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ https://flatt.tech/research/posts/batbadbut-you-cant-securel...

panzi 2y ago

PS: Somewhat related, look at the bonkers way Windows resolves the program to execute from the command line string: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw#parameters https://learn.microsoft.com/en-us/windows/win32/api/processt... PPS: Even less related, there's no exec() in Win32, so you can't write a starter program that does some setup and then runs another program (e.g. specified as a parameter). You need to keep the starter program open and act as a proxy to the started program! See the various dotenv CLI implementations. But I digress.