There is simply no way to safely pass arguments to a batch file on Windows. The way it handles argument parsing is so deeply fucked that any amount of untrusted input is intrinsically able to achieve arbitrary code execution. Clown shoes operating system.
- she/her
enthusiast enthusiast
offsite reposts: @nex3-reposts
clips & pics: @nex3-moments
Cohost utilities:
- Image grid generator
- Backloggd formatter
- Letterboxd formatter
- Timeline deduplicator
- Syntax highlighter
header photo by me
You must log in to comment.
in reply to @nex3's post:
yeah, rust just released a similar patch. https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html
That's what happens when you build your entire OS on a command line interface (correct, sensible) and then just don't update it At All for 20 fucking years (literally insane)
In fairness, PowerShell is basically their new command line, although to be completely fair, the way they have left batch files hanging around in stasis effectively negates the security benefits.
The shell isn't the fundamental issue, the fundamental issue is that it's up to the subprocess to split CLI arguments in the first place. Calling code being unable to guarantee that it accurately escapes arguments for all callees is an unavoidable consequence of that decision.
oh i didn't realize it went down to the Windows API (or maybe technically the kernel?). although it does seem like cmd.exe and batch files not being deprecated or significantly locked down makes the problem worse.
Indeed, and powershell isn't even handled as an integral component of the operating system. The up to date version isn't included with Windows as a standard update, it's something you have to go choose to download, and the more recent version installs along side the old version, compounding the issue further. It's like they're slapping sticky notes on top of foundation rot.
Yeah, I ran into this at work where I was testing things locally on my Mac using Powershell from the official site, and then realized it didn't actually work because it wasn't compatible with PS 5.1 that ships with Windows.
Everything about %PATH% and %PATHEXT% is so incredibly fucked on Windows, too. It's completely ridiculous.
thinking about when i was a kid and made a dumb little text-based-adventure game in batch called Progression. using a lot of basic coding things i learned to put together something with combat, towns to visit, and randomly generated npcs with quips to tell. mostly worked like madlibs with pulling random entries from lists based on stuff like checking system time
i wanted to send it to my friend to play, and even at like 13 thought "i probably can't just send a batch file over puush right?" and i absolutely could and windows vista let him fully download and play it. i could've done so much malware dude.
You know I don't think I realized the Node and Rust advisories were literally the same bug.
the fact that batch files are more or less unchanged from how they behaved in DOS is not just clown shoes - they're ancestral clown shoes. Ancient artifact clown shoes of a culture long collapsed and thought buried. The "pharaoh's curse" of OS features. (I love batch files, but geez...)
Pinned Tags