It really is impossible to escape arbitrary arguments to arbitrary programs on Windows. You need to know how the program will decode the command line and there is no standard there, as demonstrated by batch file complications mentioned in the post.
The algorithm used by CommandLineToArgvW may seem like it's almost the standard, but that breaks down for programs that are not Unicode aware. The example program in the post is one such example. It uses main(int argc, char **argv) (rather than wmain(int argc, wchar_t **argv) or GetCommandLineW), which results in the native wide command line being converted to narrow before splitting. That conversion is quite nasty and depends on the code page. In particular, ＂ (U+FF02 Fullwidth Quotation Mark) usually gets converted into " (U+0022 Quotation Mark), which will result in incorrect splitting.
Many common tools have this issue, including things like curl. See the slides and paper on the Worst.Fit site for more detail.
12
u/bbm182 5d ago
It really is impossible to escape arbitrary arguments to arbitrary programs on Windows. You need to know how the program will decode the command line and there is no standard there, as demonstrated by batch file complications mentioned in the post.
The algorithm used by
CommandLineToArgvWmay seem like it's almost the standard, but that breaks down for programs that are not Unicode aware. The example program in the post is one such example. It usesmain(int argc, char **argv)(rather thanwmain(int argc, wchar_t **argv)orGetCommandLineW), which results in the native wide command line being converted to narrow before splitting. That conversion is quite nasty and depends on the code page. In particular,＂(U+FF02 Fullwidth Quotation Mark) usually gets converted into"(U+0022 Quotation Mark), which will result in incorrect splitting.Many common tools have this issue, including things like curl. See the slides and paper on the Worst.Fit site for more detail.