On 9/7/26 4:55 PM, Andrew L. Moore wrote:
On 2026-09-06 12:42, Harry Graf wrote:
If the flag is set filenames will be escaped.
Okay, but what about the quoting implementation? Is wrapping in single
quotes sufficient?
I recently faced shell quoting because funny filenames allowed command
injection in commands passed to popen(). The Unix and Windows rules are
different: out solutin for Unix was to singlewuote the whole things and
map single quotes into '\''.
On Windows it's hairier as you need to double quote the whole thing
to protect spaces, then some hack I don't really understand to defeat
filenames that end in backslashes:
*q++ = '"';
for (p = filename; *p; p++)
*q++ = *p;
for (p = filename + filename_len; p > filename && p[-1] == '\\'; p--)
*q++ = '\\';
*q++ = '"';
*q = '\0';
I gather you can still inclide %VAR% in it and the environent variable
will get expanded all the same, as %s are only quoted by " in batch
scripts. See Marcrosoft's commit message for further gory details:
https://codeberg.org/sox_ng/sox_ng/commit/b815b40 amd the resulting code
is src/util.c line 470: /* Quote special characters in the filename. */
M
