Quote more batch file arguments

Make sure to quote batch file arguments that contain command prompt special characters.

Additionally add `/d` command line parameter to disable any commands that may change the way variable expansion works.
This commit is contained in:
Chris Denton 2023-02-18 14:47:01 +00:00
parent f722b24eb9
commit 0b7c867ec5
No known key found for this signature in database
GPG Key ID: 713472F2F45627DE

View File

@ -270,7 +270,7 @@ pub(crate) fn make_bat_command_line(
// It is necessary to surround the command in an extra pair of quotes,
// hence the trailing quote here. It will be closed after all arguments
// have been added.
let mut cmd: Vec<u16> = "cmd.exe /c \"".encode_utf16().collect();
let mut cmd: Vec<u16> = "cmd.exe /d /c \"".encode_utf16().collect();
// Push the script name surrounded by its quote pair.
cmd.push(b'"' as u16);
@ -290,6 +290,15 @@ pub(crate) fn make_bat_command_line(
// reconstructed by the batch script by default.
for arg in args {
cmd.push(' ' as u16);
// Make sure to always quote special command prompt characters, including:
// * Characters `cmd /?` says require quotes.
// * `%` for environment variables, as in `%TMP%`.
// * `|<>` pipe/redirect characters.
const SPECIAL: &[u8] = b"\t &()[]{}^=;!'+,`~%|<>";
let force_quotes = match arg {
Arg::Regular(arg) if !force_quotes => arg.bytes().iter().any(|c| SPECIAL.contains(c)),
_ => force_quotes,
};
append_arg(&mut cmd, arg, force_quotes)?;
}