{"action":"created","issue":{"url":"https://api.github.com/repos/HaxeFoundation/haxe/issues/3603","labels_url":"https://api.github.com/repos/HaxeFoundation/haxe/issues/3603/labels{/name}","comments_url":"https://api.github.com/repos/HaxeFoundation/haxe/issues/3603/comments","events_url":"https://api.github.com/repos/HaxeFoundation/haxe/issues/3603/events","html_url":"https://github.com/HaxeFoundation/haxe/issues/3603","id":49626662,"number":3603,"title":"Sys.command and Process.run escaping","user":{"login":"ncannasse","id":1022912,"avatar_url":"https://avatars.githubusercontent.com/u/1022912?v=3","gravatar_id":"","url":"https://api.github.com/users/ncannasse","html_url":"https://github.com/ncannasse","followers_url":"https://api.github.com/users/ncannasse/followers","following_url":"https://api.github.com/users/ncannasse/following{/other_user}","gists_url":"https://api.github.com/users/ncannasse/gists{/gist_id}","starred_url":"https://api.github.com/users/ncannasse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ncannasse/subscriptions","organizations_url":"https://api.github.com/users/ncannasse/orgs","repos_url":"https://api.github.com/users/ncannasse/repos","events_url":"https://api.github.com/users/ncannasse/events{/privacy}","received_events_url":"https://api.github.com/users/ncannasse/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"andyli","id":103977,"avatar_url":"https://avatars.githubusercontent.com/u/103977?v=3","gravatar_id":"","url":"https://api.github.com/users/andyli","html_url":"https://github.com/andyli","followers_url":"https://api.github.com/users/andyli/followers","following_url":"https://api.github.com/users/andyli/following{/other_user}","gists_url":"https://api.github.com/users/andyli/gists{/gist_id}","starred_url":"https://api.github.com/users/andyli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andyli/subscriptions","organizations_url":"https://api.github.com/users/andyli/orgs","repos_url":"https://api.github.com/users/andyli/repos","events_url":"https://api.github.com/users/andyli/events{/privacy}","received_events_url":"https://api.github.com/users/andyli/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/HaxeFoundation/haxe/milestones/5","html_url":"https://github.com/HaxeFoundation/haxe/milestones/3.3","labels_url":"https://api.github.com/repos/HaxeFoundation/haxe/milestones/5/labels","id":586975,"number":5,"title":"3.3","description":"","creator":{"login":"ncannasse","id":1022912,"avatar_url":"https://avatars.githubusercontent.com/u/1022912?v=3","gravatar_id":"","url":"https://api.github.com/users/ncannasse","html_url":"https://github.com/ncannasse","followers_url":"https://api.github.com/users/ncannasse/followers","following_url":"https://api.github.com/users/ncannasse/following{/other_user}","gists_url":"https://api.github.com/users/ncannasse/gists{/gist_id}","starred_url":"https://api.github.com/users/ncannasse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ncannasse/subscriptions","organizations_url":"https://api.github.com/users/ncannasse/orgs","repos_url":"https://api.github.com/users/ncannasse/repos","events_url":"https://api.github.com/users/ncannasse/events{/privacy}","received_events_url":"https://api.github.com/users/ncannasse/received_events","type":"User","site_admin":false},"open_issues":176,"closed_issues":106,"state":"open","created_at":"2014-03-04T14:22:27Z","updated_at":"2015-12-24T09:04:28Z","due_on":"2015-11-01T23:00:00Z","closed_at":null},"comments":16,"created_at":"2014-11-20T22:25:49Z","updated_at":"2015-12-24T09:50:11Z","closed_at":null,"body":"Escaping of command + arguments is badly handled in Neko/hxCPP : it is actually split between Haxe code and C bindings (sys_command / process_run). I think we should entirely move it to C code after we have confirmed every special shell char is correctly escaped, including funny combinations that one might not thing of.\r\n\r\nDoes anyone have actual experience hacking windows/unix shell and can make a set of unit tests for it ?\r\n\r\nCurrently we try to call a command by passing these arguments values and check if they are correctly passed : `[\"foo\", \"12\", \"a b  %PATH% $HOME c\\\\&<>[\\\"]#{}|%$\"]`"},"comment":{"url":"https://api.github.com/repos/HaxeFoundation/haxe/issues/comments/167079249","html_url":"https://github.com/HaxeFoundation/haxe/issues/3603#issuecomment-167079249","issue_url":"https://api.github.com/repos/HaxeFoundation/haxe/issues/3603","id":167079249,"user":{"login":"ncannasse","id":1022912,"avatar_url":"https://avatars.githubusercontent.com/u/1022912?v=3","gravatar_id":"","url":"https://api.github.com/users/ncannasse","html_url":"https://github.com/ncannasse","followers_url":"https://api.github.com/users/ncannasse/followers","following_url":"https://api.github.com/users/ncannasse/following{/other_user}","gists_url":"https://api.github.com/users/ncannasse/gists{/gist_id}","starred_url":"https://api.github.com/users/ncannasse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ncannasse/subscriptions","organizations_url":"https://api.github.com/users/ncannasse/orgs","repos_url":"https://api.github.com/users/ncannasse/repos","events_url":"https://api.github.com/users/ncannasse/events{/privacy}","received_events_url":"https://api.github.com/users/ncannasse/received_events","type":"User","site_admin":false},"created_at":"2015-12-24T09:50:11Z","updated_at":"2015-12-24T09:50:11Z","body":"I'm fine with it"}}