Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix incorrect argument list quoting in POSIX systems #355

Merged
merged 1 commit into from
Apr 7, 2020

Conversation

dvalter
Copy link
Contributor

@dvalter dvalter commented Apr 6, 2020

Use only shlex for POSIX systems and only subprocess.list2cmdline for NT.
According to https://bugs.python.org/issue37659 shlex and list2cmdline are
not coherent with each other so using them in conjunction may lead to
quoting correct neigher in Unix nor in Windows.

One simple example is 'app 1.apk'. It will be quoted once by shlex
("'app 1.apk'") and another time by cmdline resulting in mad
"\"'app 1.apk'\"". Removing shlex won't help because of bug #234. At the same
time shlex won't work with NT (python bug 37659), so the only reasonable fix
is splitting them based on the OS.

Use only shlex for POSIX systems and only subprocess.list2cmdline for NT.
According to https://bugs.python.org/issue37659 shlex and list2cmdline are
not coherent with each other so using them in conjunction may lead to
quoting correct neigher in Unix nor in Windows.

One simple example is 'app 1.apk'. It will be quoted once by shlex
("'app 1.apk'") and another time by cmdline resulting in mad
"\"'app 1.apk'\"". Removing shlex won't help because of bug sensepost#234. At the same
time shlex won't work with NT (python bug 37659), so the only reasonable fix
is splitting them based on the OS.
@leonjza
Copy link
Member

leonjza commented Apr 6, 2020

Amazing! Thanks! 🙏

@leonjza leonjza merged commit ae84919 into sensepost:master Apr 7, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants