Re: 0.2808_04 will not install in Strawberry Perl 5.10.0.2...

On Mon, Sep 15, 2008 at 11:10:29PM -0500, Ken Williams wrote:
> On Mon, Sep 15, 2008 at 10:46 PM, Jan Dubois <[email protected]> wrote:
> > On Mon, 15 Sep 2008, Ken Williams wrote:
> >> I think the correct fix for this would be to write a _quote_args()
> >> method in Module/Build/Platform/Windows.pm .  It's trying to use Unix
> >> shell semantics.  In this case, it shouldn't need to use any quotes at
> >> all, since backslashes are fine in the Windows shell.
> >
> > I suspect the quoting is there in case the path contains some whitespace,
> > e.g. as "C:\Program Files\Perl\bin\perl.exe", which would need the quotes.
> 
> Right, if it matches the (Unix-centric) regex
> /^[^\s*?!\$<>;\\|'"\[\]\{\}]+$/ then we don't do any quoting.  So
> whitespace would force quoting.
> 
> That regex has always scared me, I would rather have a list of
> known-good characters instead of known-bad ones.  I don't remember
> where I got that regex, I'm pretty sure I didn't make it up though.

Well, it's already broken as I can sneak a string ending in a newline past it,
but the shell will treat that unquoted newline as whitespace.
Not sure how I can use that to make an attack though.

Also, it doesn't contain #, so I think I can have fun with shell comments.
Nor does it contain ` or ( or ) or &

I'm sure I read somewhere that really really old shells treat ^ as a synonym
for |, but I can't find one anywhere that does.

Nicholas Clark