Hacker News Reader

Comment by flohofwoe | Hacker News Reader

My main gripe is "windows-aware" joinPath implementations which try to be helpful and use backslash as path separators when running on Windows (which then might be removed by other code which assumes that backslash is an escape-character). Just use forward slashes everywhere, it's fine and always has been fine since at least the mid-90s.

View on HN

At risk of picking nits, I feel like if the output of a joinPath call is being used somewhere where escapes can be interpreted at all, something that has nothing to do with your choice of path separator is very wrong.

A common problem is building a command line with paths created with such a Windows-aware joinPath function and then executing that command line.

If that execution is handled by a shell instead of going directly through an operating system's CreateProcess() function, then the command line string may be mangled either by the shell, or some other "helpful" code sitting inbetween which tries to resolve backslash-escapes (which are usually needed in front of quotation marks).

It a very typical problem in cross-platform Python code, and I think I also stumbled over it in Node.js.

That sounds like an RCE waiting to happen.

The canonical way to solve this would be to pass the components of that command line through a function that escapes or quotes anything that needs to be escaped. In Ruby and when using bash for example we have [0].

Does Windows have something similar?

[0]: https://ruby-doc.org/stdlib-2.5.1/libdoc/shellwords/rdoc/She...

Reply on news.ycombinator.com