4 ms·

I tend to agree that this is not an issue with many of the applications that are mentioned in the post. Fundamentally this boils down to essentially bugs in fu

I tend to agree that this is not an issue with many of the applications that are mentioned in the post. Fundamentally this boils down to essentially bugs in functions that are supposed to transform untrusted into trusted input like the example they gave: `system("wget.exe -q " . escapeshellarg($url));` `escapeshellarg` is not producing a trusted output with some certain inputs.

blibble 2y ago
the escaping rules for windows are so complicated (and can vary with configuration) such that it's not possible to do it securely vs. posix that just dumps the arguments directly into argv
- hnlmorg 2y ago
  Windows doesn’t really have an ARGV though. It’s a user space abstraction for compatibility with POSIX. Windows technically just works on the principle of an executable name + a single argument. And it does this for compatibility with DOS. So you end up with this stupid escaping rules you’ve described so there are compatibility conventions at the kernel level with earlier implementations of Windows, which in turn maintained compatibility with MS-DOS. While providing a C abstraction that’s compatible with POSIX. Which is just one of many reasons why it’s a nightmare to write cross platform shells that also target Windows.
- bangaladore 2y ago
  > the escaping rules for windows are so complicated (and can vary with configuration) such that it's not possible to do it securely This is bold claim. Is it not possible? Or not easy to do correctly?
  - blibble 2y ago
    all the kernel passes to executables is one long string and then every program handles it in whatever way it feels is best as examples: go/java/python all process arguments slightly differently even microsoft's libc changes handling between versions given it's not possible to know what parser a specific target program is going to use: it's not possible to generically serialise an array safely
    - Aachen 2y ago
      Okay so it's not that the rules are too complicated for mortals, it's that there are no rules and so you can't know how programs will interpret the data, so you can't write anything that would universally work. Am I understanding that right?

blibble 2y ago

the escaping rules for windows are so complicated (and can vary with configuration) such that it's not possible to do it securely vs. posix that just dumps the arguments directly into argv

hnlmorg 2y ago
Windows doesn’t really have an ARGV though. It’s a user space abstraction for compatibility with POSIX. Windows technically just works on the principle of an executable name + a single argument. And it does this for compatibility with DOS. So you end up with this stupid escaping rules you’ve described so there are compatibility conventions at the kernel level with earlier implementations of Windows, which in turn maintained compatibility with MS-DOS. While providing a C abstraction that’s compatible with POSIX. Which is just one of many reasons why it’s a nightmare to write cross platform shells that also target Windows.
bangaladore 2y ago
> the escaping rules for windows are so complicated (and can vary with configuration) such that it's not possible to do it securely This is bold claim. Is it not possible? Or not easy to do correctly?
- blibble 2y ago
  all the kernel passes to executables is one long string and then every program handles it in whatever way it feels is best as examples: go/java/python all process arguments slightly differently even microsoft's libc changes handling between versions given it's not possible to know what parser a specific target program is going to use: it's not possible to generically serialise an array safely
  - Aachen 2y ago
    Okay so it's not that the rules are too complicated for mortals, it's that there are no rules and so you can't know how programs will interpret the data, so you can't write anything that would universally work. Am I understanding that right?