Re: Is there a reason why the "winbox-args" code has not beenadoptedinto the PHP source code for escapeshellarg()?

On 24.08.2020 at 20:57, [email protected] wrote:

> Aug 24, 2020, 6:02 PM by [email protected]:
>
>> Proper escaping on Windows isn't a nightmare =E2=80=93 it is impossible
>
> So you are implying that the code I linked to is wrong in some way? How =
exactly? If it were impossible, nothing would work on Windows, but that's =
not the case.

Some commands have different rules for escaping, arguments given after a
pipe operator have different rules for escaping, so there is no
*general* solution for implementing escapeshellarg() in a proper way.
However, most user would probaly assume that they can use
escapeshellarg() as on Linux, and that could be a serious issue, so
escapeshellarg() just removes all characters which might cause that
issue.  Blunt but safe.

> And you entirely ignored my question about how file_exists=C2=A0 is able=
 to see any file...

Well, file_exists is not implemented as batch command.

>> Anyhow, in most cases you don't need to have cmd.exe involved, and in
>> these cases escaping is way simpler, and readily available as of PHP
>> 7.4.0 if you pass an array as first argument to proc_open() instead of =
a
>> string.
>
> I don't know what you mean by "having cmd.exe involved". I'm talking abo=
ut PHP -- not cmd.exe.
>
> proc_open() is just one of many different functions, and it's significan=
tly more complex and difficult to use than the others. I'm aware of its ex=
istence and its new way of sending an array. Why haven't the other functio=
ns also been upgraded like that? Do you not realize what a massive underta=
king it would be to completely re-learn a different function and change al=
l of my existing code to instead start using proc_open()?

All program execution functions in PHP's standard library are going
through cmd.exe (more precisely through %COMSPEC%), except for
proc_open() with the bypass_shell option set to TRUE.  This is the
reason why you may need to shell-escape the arguments.  If you bypass
the shell, argument escaping becomes actually quite simple[1].

[1]
<https://docs.microsoft.com/de-de/cpp/c-language/parsing-c-command-line-ar=
guments?view=3Dvs-2019>

=2D-
Christoph M. Becker