Windows: Resolve `process::Command` program without using the current directory #87704

ChrisDenton · 2021-08-02T16:08:29Z

Currently std::process::Command searches many directories for the executable to run, including the current directory. This has lead to a CVE for ripgrep but presumably other command line utilities could be similarly vulnerable if they run commands. This was discussed on the internals forum. Also discussed was which directories should be searched.

EDIT: This PR originally removed all implicit paths. They've now been added back as laid out in the rest of this comment.

Old Search Strategy

The old search strategy is documented here. Additionally Rust adds searching the child's paths (see also #37519). So the full list of paths that were searched was:

The directories that are listed in the child's PATH environment variable.
The directory from which the application loaded.
The current directory for the parent process.
The 32-bit Windows system directory.
The 16-bit Windows system directory.
The Windows directory.
The directories that are listed in the PATH environment variable.

New Search Strategy

The new strategy removes the current directory from the searched paths.

The directories that are listed in the child's PATH environment variable.
The directory from which the application loaded.
The 32-bit Windows system directory.
The Windows directory.
The directories that are listed in the parent's PATH environment variable.

Note that it also removes the 16-bit system directory, mostly because there isn't a function to get it. I do not anticipate this being an issue in modern Windows.

Impact

Removing the current directory should fix CVE's like the one linked above. However, it's possible some Windows users of affected Rust CLI applications have come to expect the old behaviour.

This change could also affect small Windows-only script-like programs that assumed the current directory would be used. The user would need to use .\file.exe instead of the bare application name.

This PR could break tests, especially those that test the exact output of error messages (e.g. Cargo) as this does change the error messages is some cases.

rust-highfive · 2021-08-02T16:08:32Z

r? @dtolnay

(rust-highfive has picked a reviewer for you, use r? to override)

library/std/src/sys/windows/process.rs

bors · 2021-08-12T16:37:40Z

☔ The latest upstream changes (presumably #87963) made this pull request unmergeable. Please resolve the merge conflicts.

ChrisDenton · 2021-08-14T12:08:25Z

As mentioned in #87945, I've changed this PR to only remove the current directory. This allows focusing on the most pressing issue and avoids conflating separate issues.

I've also made sure to otherwise maintain much of the existing behaviour, including the running of .bat files. However the CreateProcessW docs say this, which suggests it shouldn't work:

To run a batch file, you must start the command interpreter; set lpApplicationName to cmd.exe and set lpCommandLine to the following arguments: /c plus the name of the batch file.

Not documented is that CreateProcessW will actually do this for if you use a file name ending with .bat. I.e. it sets lpApplicationName to cmd.exe (thereby discarding the file name you used). It then passes lpCommandLine so that it's as though that line was typed directly in the shell. One weird effect of this is if argv[0] is set to some arbitrary command, that will then be run instead of the script.

I would recommend that users should not rely on this being maintained. It's undocumented (or anti-documented?) and a bit strange. Instead it would be better to do as the docs suggest and run cmd.exe manually using the /c switch followed by the path to the script.

dtolnay · 2021-08-14T21:08:50Z

@rustbot ping windows

Could some of you take a look at #87704 (comment) and sanity check whether the changed behavior is what developers should expect on your platform?

rustbot · 2021-08-14T21:08:53Z

Hey Windows Group! This bug has been identified as a good "Windows candidate".
In case it's useful, here are some instructions for tackling these sorts of
bugs. Maybe take a look?
Thanks! <3

cc @arlosi @danielframpton @gdr-at-ms @kennykerr @luqmana @lzybkr @nico-abram @retep998 @rylev @sivadeilra @wesleywiser

bk2204 · 2021-08-14T21:23:38Z

Unfortunately, the directory from which the application loaded isn't a secure option, either. If someone has a self-installing executable that's downloaded into a temporary directory or downloads directory, it isn't safe to execute programs from that directory. This behavior, except with DLLs, is the cause of a large number of security vulnerabilities.

My preference is that we don't have implicit behavior. It makes it difficult to reason about the behavior of Rust programs across existing systems, especially for programmers like me who do not normally target Windows. For example, a Rust program working in a MINGW environment may want the MINGW find program which is Unix-like, not the built-in find program shipped with Windows, and implicitly adding directories means that they will get unexpected behavior in that case. It also can't be overridden, unlike changing the PATH environment variable, so users are basically unable to opt-out of the implicit behavior.

ChrisDenton · 2021-08-14T21:56:31Z

I agree that I would rather avoid all implicit behaviours and only search PATH by default. I am however becoming increasingly worried about the impact this will have. It's hard to assess before it happens.

A "half way" option would be to reorder the search paths to give higher priority to the parent's PATH. This is not ideal but it would at least mitigate some of the issues you mention.

bk2204 · 2021-08-14T22:11:55Z

I appreciate that it's difficult to make the change to use only PATH due to the risk of breakage. However, that is the documented behavior, and it's the only behavior that people can safely rely on. In the most technical sense, the current behavior is a bug since it doesn't conform to the documentation. Doing a half-way approach means that Rust will continue to have a security vulnerability and it will continue to be unsafe to write cross-platform code with Rust.

It would be better to just change things to do what the documentation says and make the change once so that users don't have to deal with any future changes here.

bors · 2021-08-20T13:49:29Z

☔ The latest upstream changes (presumably #87329) made this pull request unmergeable. Please resolve the merge conflicts.

joshtriplett · 2021-10-04T14:33:08Z

I think this is a change we should make. Doing the search ourselves and removing the current directory is an important security fix. We should call attention to this in the release notes, and give people plenty of time to notice issues.

@rfcbot merge

rfcbot · 2021-10-04T14:33:09Z

Team member @joshtriplett has proposed to merge this. The next step is review by the rest of the tagged team members:

No concerns currently listed.

Once a majority of reviewers approve (and at most 2 approvals are outstanding), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for info about what commands tagged team members can give me.

Match any error when failing to find executables For Windows targets, Rust now uses [a custom resolver](rust-lang/rust#87704) to find `process::Command` programs. This has caused some error messages to change. To allow the PR to be merged, some tests have been adjusted to match any error. cc `@ehuss`

ChrisDenton · 2021-11-18T11:33:27Z

Is anyone available to do retry bors now that #90991 has landed?

Amanieu · 2021-11-18T14:22:05Z

@bors retry

bors · 2021-11-20T18:23:14Z

⌛ Testing commit d9a1f9a with merge 2885c47...

bors · 2021-11-20T21:37:46Z

☀️ Test successful - checks-actions
Approved by: yaahc
Pushing 2885c47 to master...

rust-timer · 2021-11-20T23:41:39Z

Finished benchmarking commit (2885c47): comparison url.

Summary: This benchmark run did not return any relevant changes.

If you disagree with this performance assessment, please file an issue in rust-lang/rustc-perf.

@rustbot label: -perf-regression

Pkgsrc changes: * Bump available bootstraps to 1.57.0. * For some reason, the vendor/libc checksums don't need fixing. * Bump required external LLVM to 12.0, according to upstream change log. * Adapt the Darwin linker patch. (For some reason I've not figured out yet, cargo is a lot more verbose while building, echoes the rustc invocation.) Upstream changes: Version 1.58.1 (2022-01-19) =========================== * Fix race condition in `std::fs::remove_dir_all` ([CVE-2022-21658]) * [Handle captured arguments in the `useless_format` Clippy lint][clippy/8295] * [Move `non_send_fields_in_send_ty` Clippy lint to nursery][clippy/8075] * [Fix wrong error message displayed when some imports are missing][91254] * [Fix rustfmt not formatting generated files from stdin][92912] [CVE-2022-21658]: https://www.cve.org/CVERecord?id=CVE-2022-21658] [91254]: rust-lang/rust#91254 [92912]: rust-lang/rust#92912 [clippy/8075]: rust-lang/rust-clippy#8075 [clippy/8295]: rust-lang/rust-clippy#8295 Version 1.58.0 (2022-01-13) ========================== Language -------- - [Format strings can now capture arguments simply by writing `{ident}` in the string.][90473] This works in all macros accepting format strings. Support for this in `panic!` (`panic!("{ident}")`) requires the 2021 edition; panic invocations in previous editions that appear to be trying to use this will result in a warning lint about not having the intended effect. - [`*const T` pointers can now be dereferenced in const contexts.][89551] - [The rules for when a generic struct implements `Unsize` have been relaxed.][90417] Compiler -------- - [Add LLVM CFI support to the Rust compiler][89652] - [Stabilize -Z strip as -C strip][90058]. Note that while release builds already don't add debug symbols for the code you compile, the compiled standard library that ships with Rust includes debug symbols, so you may want to use the `strip` option to remove these symbols to produce smaller release binaries. Note that this release only includes support in rustc, not directly in cargo. - [Add support for LLVM coverage mapping format versions 5 and 6][91207] - [Emit LLVM optimization remarks when enabled with `-Cremark`][90833] - [Update the minimum external LLVM to 12][90175] - [Add `x86_64-unknown-none` at Tier 3*][89062] - [Build musl dist artifacts with debuginfo enabled][90733]. When building release binaries using musl, you may want to use the newly stabilized strip option to remove these debug symbols, reducing the size of your binaries. - [Don't abort compilation after giving a lint error][87337] - [Error messages point at the source of trait bound obligations in more places][89580] \* Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support. Libraries --------- - [All remaining functions in the standard library have `#[must_use]` annotations where appropriate][89692], producing a warning when ignoring their return value. This helps catch mistakes such as expecting a function to mutate a value in place rather than return a new value. - [Paths are automatically canonicalized on Windows for operations that support it][89174] - [Re-enable debug checks for `copy` and `copy_nonoverlapping`][90041] - [Implement `RefUnwindSafe` for `Rc<T>`][87467] - [Make RSplit<T, P>: Clone not require T: Clone][90117] - [Implement `Termination` for `Result<Infallible, E>`][88601]. This allows writing `fn main() -> Result<Infallible, ErrorType>`, for a program whose successful exits never involve returning from `main` (for instance, a program that calls `exit`, or that uses `exec` to run another program). Stabilized APIs --------------- - [`Metadata::is_symlink`] - [`Path::is_symlink`] - [`{integer}::saturating_div`] - [`Option::unwrap_unchecked`] - [`Result::unwrap_unchecked`] - [`Result::unwrap_err_unchecked`] - [`NonZero{unsigned}::is_power_of_two`] - [`File::options`] These APIs are now usable in const contexts: - [`Duration::new`] - [`Duration::checked_add`] - [`Duration::saturating_add`] - [`Duration::checked_sub`] - [`Duration::saturating_sub`] - [`Duration::checked_mul`] - [`Duration::saturating_mul`] - [`Duration::checked_div`] - [`MaybeUninit::as_ptr`] - [`MaybeUninit::as_mut_ptr`] - [`MaybeUninit::assume_init`] - [`MaybeUninit::assume_init_ref`] Cargo ----- - [Add --message-format for install command][cargo/10107] - [Warn when alias shadows external subcommand][cargo/10082] Rustdoc ------- - [Show all Deref implementations recursively in rustdoc][90183] - [Use computed visibility in rustdoc][88447] Compatibility Notes ------------------- - [Try all stable method candidates first before trying unstable ones][90329]. This change ensures that adding new nightly-only methods to the Rust standard library will not break code invoking methods of the same name from traits outside the standard library. - Windows: [`std::process::Command` will no longer search the current directory for executables.][87704] - [All proc-macro backward-compatibility lints are now deny-by-default.][88041] - [proc_macro: Append .0 to unsuffixed float if it would otherwise become int token][90297] - [Refactor weak symbols in std::sys::unix][90846]. This optimizes accesses to glibc functions, by avoiding the use of dlopen. This does not increase the [minimum expected version of glibc](https://doc.rust-lang.org/nightly/rustc/platform-support.html). However, software distributions that use symbol versions to detect library dependencies, and which take weak symbols into account in that analysis, may detect rust binaries as requiring newer versions of glibc. - [rustdoc now rejects some unexpected semicolons in doctests][91026] Internal Changes ---------------- These changes provide no direct user facing benefits, but represent significant improvements to the internals and overall performance of rustc and related tools. - [Implement coherence checks for negative trait impls][90104] - [Add rustc lint, warning when iterating over hashmaps][89558] - [Optimize live point computation][90491] - [Enable verification for 1/32nd of queries loaded from disk][90361] - [Implement version of normalize_erasing_regions that allows for normalization failure][91255] [87337]: rust-lang/rust#87337 [87467]: rust-lang/rust#87467 [87704]: rust-lang/rust#87704 [88041]: rust-lang/rust#88041 [88300]: rust-lang/rust#88300 [88447]: rust-lang/rust#88447 [88601]: rust-lang/rust#88601 [88624]: rust-lang/rust#88624 [89062]: rust-lang/rust#89062 [89174]: rust-lang/rust#89174 [89542]: rust-lang/rust#89542 [89551]: rust-lang/rust#89551 [89558]: rust-lang/rust#89558 [89580]: rust-lang/rust#89580 [89652]: rust-lang/rust#89652 [89677]: rust-lang/rust#89677 [89951]: rust-lang/rust#89951 [90041]: rust-lang/rust#90041 [90058]: rust-lang/rust#90058 [90104]: rust-lang/rust#90104 [90117]: rust-lang/rust#90117 [90175]: rust-lang/rust#90175 [90183]: rust-lang/rust#90183 [90297]: rust-lang/rust#90297 [90329]: rust-lang/rust#90329 [90361]: rust-lang/rust#90361 [90417]: rust-lang/rust#90417 [90473]: rust-lang/rust#90473 [90491]: rust-lang/rust#90491 [90733]: rust-lang/rust#90733 [90833]: rust-lang/rust#90833 [90846]: rust-lang/rust#90846 [90896]: rust-lang/rust#90896 [91026]: rust-lang/rust#91026 [91207]: rust-lang/rust#91207 [91255]: rust-lang/rust#91255 [91301]: rust-lang/rust#91301 [cargo/10082]: rust-lang/cargo#10082 [cargo/10107]: rust-lang/cargo#10107 [`Metadata::is_symlink`]: https://doc.rust-lang.org/stable/std/fs/struct.Metadata.html#method.is_symlink [`Path::is_symlink`]: https://doc.rust-lang.org/stable/std/path/struct.Path.html#method.is_symlink [`{integer}::saturating_div`]: https://doc.rust-lang.org/stable/std/primitive.i8.html#method.saturating_div [`Option::unwrap_unchecked`]: https://doc.rust-lang.org/stable/std/option/enum.Option.html#method.unwrap_unchecked [`Result::unwrap_unchecked`]: https://doc.rust-lang.org/stable/std/result/enum.Result.html#method.unwrap_unchecked [`Result::unwrap_err_unchecked`]: https://doc.rust-lang.org/stable/std/result/enum.Result.html#method.unwrap_err_unchecked [`NonZero{unsigned}::is_power_of_two`]: https://doc.rust-lang.org/stable/std/num/struct.NonZeroU8.html#method.is_power_of_two [`File::options`]: https://doc.rust-lang.org/stable/std/fs/struct.File.html#method.options [`unix::process::ExitStatusExt::core_dumped`]: https://doc.rust-lang.org/stable/std/os/unix/process/trait.ExitStatusExt.html#tymethod.core_dumped [`unix::process::ExitStatusExt::stopped_signal`]: https://doc.rust-lang.org/stable/std/os/unix/process/trait.ExitStatusExt.html#tymethod.stopped_signal [`unix::process::ExitStatusExt::continued`]: https://doc.rust-lang.org/stable/std/os/unix/process/trait.ExitStatusExt.html#tymethod.continued [`unix::process::ExitStatusExt::into_raw`]: https://doc.rust-lang.org/stable/std/os/unix/process/trait.ExitStatusExt.html#tymethod.into_raw [`Duration::new`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.new [`Duration::checked_add`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.checked_add [`Duration::saturating_add`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.saturating_add [`Duration::checked_sub`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.checked_sub [`Duration::saturating_sub`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.saturating_sub [`Duration::checked_mul`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.checked_mul [`Duration::saturating_mul`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.saturating_mul [`Duration::checked_div`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.checked_div [`Duration::as_secs_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.as_secs_f64 [`Duration::as_secs_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.as_secs_f32 [`Duration::from_secs_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.from_secs_f64 [`Duration::from_secs_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.from_secs_f32 [`Duration::mul_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.mul_f64 [`Duration::mul_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.mul_f32 [`Duration::div_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.div_f64 [`Duration::div_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.div_f32 [`Duration::div_duration_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.div_duration_f64 [`Duration::div_duration_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.div_duration_f32 [`MaybeUninit::as_ptr`]: https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#method.as_ptr [`MaybeUninit::as_mut_ptr`]: https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#method.as_mut_ptr [`MaybeUninit::assume_init`]: https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#method.assume_init [`MaybeUninit::assume_init_ref`]: https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#method.assume_init_ref

…=m-ou-se Maintain broken symlink behaviour for the Windows exe resolver When the resolver was updated to remove the current directory from the search path (see rust-lang#87704), care was take to avoid unintentional changes that hadn't been discussed. However, I missed the broken symlink behaviour. This PR fixes that. **Edit** This turned out to be more important than I first realised. There are some types of application stubs that will redirect to the actual process when run using `CreateProcessW`, but due to the way they're implemented they cannot be opened normally using a `File::open` that follows reparse points. So this doesn't work with our current `exists` and `try_exists` methods. Fixes rust-lang#91177

Pkgsrc changes: * Bump bootstrap kit version to 1.57.0. * Bump require external LLVM to 12.0, according to upstream change log. * Adjust patches as needed, adjust line numbers. * Update checksum adjustments. For some reason the vendor/libc checksum doesn't need fixing, apparently, it remains as commented out. * Add makefile to do all the NetBSD boostrap/cross builds (do-cross.mk). Allow passing in additions to CONFIGURE_ARGS via ADD_CONFIGURE_ARGS. Upstream changes: Version 1.58.1 (2022-01-19) =========================== * Fix race condition in `std::fs::remove_dir_all` ([CVE-2022-21658]) * [Handle captured arguments in the `useless_format` Clippy lint][clippy/8295] * [Move `non_send_fields_in_send_ty` Clippy lint to nursery][clippy/8075] * [Fix wrong error message displayed when some imports are missing][91254] * [Fix rustfmt not formatting generated files from stdin][92912] [CVE-2022-21658]: https://www.cve.org/CVERecord?id=CVE-2022-21658] [91254]: rust-lang/rust#91254 [92912]: rust-lang/rust#92912 [clippy/8075]: rust-lang/rust-clippy#8075 [clippy/8295]: rust-lang/rust-clippy#8295 Version 1.58.0 (2022-01-13) ========================== Language -------- - [Format strings can now capture arguments simply by writing `{ident}` in the string.][90473] This works in all macros accepting format strings. Support for this in `panic!` (`panic!("{ident}")`) requires the 2021 edition; panic invocations in previous editions that appear to be trying to use this will result in a warning lint about not having the intended effect. - [`*const T` pointers can now be dereferenced in const contexts.][89551] - [The rules for when a generic struct implements `Unsize` have been relaxed.][90417] Compiler -------- - [Add LLVM CFI support to the Rust compiler][89652] - [Stabilize -Z strip as -C strip][90058]. Note that while release builds already don't add debug symbols for the code you compile, the compiled standard library that ships with Rust includes debug symbols, so you may want to use the `strip` option to remove these symbols to produce smaller release binaries. Note that this release only includes support in rustc, not directly in cargo. - [Add support for LLVM coverage mapping format versions 5 and 6][91207] - [Emit LLVM optimization remarks when enabled with `-Cremark`][90833] - [Update the minimum external LLVM to 12][90175] - [Add `x86_64-unknown-none` at Tier 3*][89062] - [Build musl dist artifacts with debuginfo enabled][90733]. When building release binaries using musl, you may want to use the newly stabilized strip option to remove these debug symbols, reducing the size of your binaries. - [Don't abort compilation after giving a lint error][87337] - [Error messages point at the source of trait bound obligations in more places][89580] \* Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support. Libraries --------- - [All remaining functions in the standard library have `#[must_use]` annotations where appropriate][89692], producing a warning when ignoring their return value. This helps catch mistakes such as expecting a function to mutate a value in place rather than return a new value. - [Paths are automatically canonicalized on Windows for operations that support it][89174] - [Re-enable debug checks for `copy` and `copy_nonoverlapping`][90041] - [Implement `RefUnwindSafe` for `Rc<T>`][87467] - [Make RSplit<T, P>: Clone not require T: Clone][90117] - [Implement `Termination` for `Result<Infallible, E>`][88601]. This allows writing `fn main() -> Result<Infallible, ErrorType>`, for a program whose successful exits never involve returning from `main` (for instance, a program that calls `exit`, or that uses `exec` to run another program). Stabilized APIs --------------- - [`Metadata::is_symlink`] - [`Path::is_symlink`] - [`{integer}::saturating_div`] - [`Option::unwrap_unchecked`] - [`Result::unwrap_unchecked`] - [`Result::unwrap_err_unchecked`] - [`NonZero{unsigned}::is_power_of_two`] - [`File::options`] These APIs are now usable in const contexts: - [`Duration::new`] - [`Duration::checked_add`] - [`Duration::saturating_add`] - [`Duration::checked_sub`] - [`Duration::saturating_sub`] - [`Duration::checked_mul`] - [`Duration::saturating_mul`] - [`Duration::checked_div`] - [`MaybeUninit::as_ptr`] - [`MaybeUninit::as_mut_ptr`] - [`MaybeUninit::assume_init`] - [`MaybeUninit::assume_init_ref`] Cargo ----- - [Add --message-format for install command][cargo/10107] - [Warn when alias shadows external subcommand][cargo/10082] Rustdoc ------- - [Show all Deref implementations recursively in rustdoc][90183] - [Use computed visibility in rustdoc][88447] Compatibility Notes ------------------- - [Try all stable method candidates first before trying unstable ones][90329]. This change ensures that adding new nightly-only methods to the Rust standard library will not break code invoking methods of the same name from traits outside the standard library. - Windows: [`std::process::Command` will no longer search the current directory for executables.][87704] - [All proc-macro backward-compatibility lints are now deny-by-default.][88041] - [proc_macro: Append .0 to unsuffixed float if it would otherwise become int token][90297] - [Refactor weak symbols in std::sys::unix][90846]. This optimizes accesses to glibc functions, by avoiding the use of dlopen. This does not increase the [minimum expected version of glibc](https://doc.rust-lang.org/nightly/rustc/platform-support.html). However, software distributions that use symbol versions to detect library dependencies, and which take weak symbols into account in that analysis, may detect rust binaries as requiring newer versions of glibc. - [rustdoc now rejects some unexpected semicolons in doctests][91026] Internal Changes ---------------- These changes provide no direct user facing benefits, but represent significant improvements to the internals and overall performance of rustc and related tools. - [Implement coherence checks for negative trait impls][90104] - [Add rustc lint, warning when iterating over hashmaps][89558] - [Optimize live point computation][90491] - [Enable verification for 1/32nd of queries loaded from disk][90361] - [Implement version of normalize_erasing_regions that allows for normalization failure][91255] [87337]: rust-lang/rust#87337 [87467]: rust-lang/rust#87467 [87704]: rust-lang/rust#87704 [88041]: rust-lang/rust#88041 [88300]: rust-lang/rust#88300 [88447]: rust-lang/rust#88447 [88601]: rust-lang/rust#88601 [88624]: rust-lang/rust#88624 [89062]: rust-lang/rust#89062 [89174]: rust-lang/rust#89174 [89542]: rust-lang/rust#89542 [89551]: rust-lang/rust#89551 [89558]: rust-lang/rust#89558 [89580]: rust-lang/rust#89580 [89652]: rust-lang/rust#89652 [89677]: rust-lang/rust#89677 [89951]: rust-lang/rust#89951 [90041]: rust-lang/rust#90041 [90058]: rust-lang/rust#90058 [90104]: rust-lang/rust#90104 [90117]: rust-lang/rust#90117 [90175]: rust-lang/rust#90175 [90183]: rust-lang/rust#90183 [90297]: rust-lang/rust#90297 [90329]: rust-lang/rust#90329 [90361]: rust-lang/rust#90361 [90417]: rust-lang/rust#90417 [90473]: rust-lang/rust#90473 [90491]: rust-lang/rust#90491 [90733]: rust-lang/rust#90733 [90833]: rust-lang/rust#90833 [90846]: rust-lang/rust#90846 [90896]: rust-lang/rust#90896 [91026]: rust-lang/rust#91026 [91207]: rust-lang/rust#91207 [91255]: rust-lang/rust#91255 [91301]: rust-lang/rust#91301 [cargo/10082]: rust-lang/cargo#10082 [cargo/10107]: rust-lang/cargo#10107 [`Metadata::is_symlink`]: https://doc.rust-lang.org/stable/std/fs/struct.Metadata.html#method.is_symlink [`Path::is_symlink`]: https://doc.rust-lang.org/stable/std/path/struct.Path.html#method.is_symlink [`{integer}::saturating_div`]: https://doc.rust-lang.org/stable/std/primitive.i8.html#method.saturating_div [`Option::unwrap_unchecked`]: https://doc.rust-lang.org/stable/std/option/enum.Option.html#method.unwrap_unchecked [`Result::unwrap_unchecked`]: https://doc.rust-lang.org/stable/std/result/enum.Result.html#method.unwrap_unchecked [`Result::unwrap_err_unchecked`]: https://doc.rust-lang.org/stable/std/result/enum.Result.html#method.unwrap_err_unchecked [`NonZero{unsigned}::is_power_of_two`]: https://doc.rust-lang.org/stable/std/num/struct.NonZeroU8.html#method.is_power_of_two [`File::options`]: https://doc.rust-lang.org/stable/std/fs/struct.File.html#method.options [`unix::process::ExitStatusExt::core_dumped`]: https://doc.rust-lang.org/stable/std/os/unix/process/trait.ExitStatusExt.html#tymethod.core_dumped [`unix::process::ExitStatusExt::stopped_signal`]: https://doc.rust-lang.org/stable/std/os/unix/process/trait.ExitStatusExt.html#tymethod.stopped_signal [`unix::process::ExitStatusExt::continued`]: https://doc.rust-lang.org/stable/std/os/unix/process/trait.ExitStatusExt.html#tymethod.continued [`unix::process::ExitStatusExt::into_raw`]: https://doc.rust-lang.org/stable/std/os/unix/process/trait.ExitStatusExt.html#tymethod.into_raw [`Duration::new`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.new [`Duration::checked_add`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.checked_add [`Duration::saturating_add`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.saturating_add [`Duration::checked_sub`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.checked_sub [`Duration::saturating_sub`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.saturating_sub [`Duration::checked_mul`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.checked_mul [`Duration::saturating_mul`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.saturating_mul [`Duration::checked_div`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.checked_div [`Duration::as_secs_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.as_secs_f64 [`Duration::as_secs_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.as_secs_f32 [`Duration::from_secs_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.from_secs_f64 [`Duration::from_secs_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.from_secs_f32 [`Duration::mul_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.mul_f64 [`Duration::mul_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.mul_f32 [`Duration::div_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.div_f64 [`Duration::div_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.div_f32 [`Duration::div_duration_f64`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.div_duration_f64 [`Duration::div_duration_f32`]: https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.div_duration_f32 [`MaybeUninit::as_ptr`]: https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#method.as_ptr [`MaybeUninit::as_mut_ptr`]: https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#method.as_mut_ptr [`MaybeUninit::assume_init`]: https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#method.assume_init [`MaybeUninit::assume_init_ref`]: https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#method.assume_init_ref

… r=dtolnay Use verbatim paths for `process::Command` if necessary In rust-lang#89174, the standard library started using verbatim paths so longer paths are usable by default. However, `Command` was originally left out because of the way `CreateProcessW` was being called. This was changed as a side effect of rust-lang#87704 so now `Command` paths can be converted to verbatim too (if necessary).

rust-highfive assigned dtolnay Aug 2, 2021

rust-highfive added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Aug 2, 2021

hkratz reviewed Aug 2, 2021

View reviewed changes

library/std/src/sys/windows/process.rs Outdated Show resolved Hide resolved

dtolnay added T-libs-api Relevant to the library API team, which will review and decide on the PR/issue. needs-fcp This change is insta-stable, so needs a completed FCP to proceed. labels Aug 2, 2021

ChrisDenton force-pushed the win-resolve-exe branch from a804554 to f919c12 Compare August 3, 2021 11:33

hkratz reviewed Aug 4, 2021

View reviewed changes

library/std/src/sys/windows/process.rs Outdated Show resolved Hide resolved

ChrisDenton force-pushed the win-resolve-exe branch from f919c12 to 75dae96 Compare August 4, 2021 12:33

Urgau mentioned this pull request Aug 11, 2021

Insecure behavior in std::process::Command on Windows #87945

Open

This comment has been minimized.

Sign in to view

ChrisDenton force-pushed the win-resolve-exe branch from 5410b28 to bbe9647 Compare August 14, 2021 12:04

ChrisDenton changed the title ~~Windows: Resolve process::Command program using only the PATH~~ Windows: Resolve process::Command program without using the current directory Aug 14, 2021

rustbot added the O-windows Operating system: Windows label Aug 14, 2021

joshtriplett added the relnotes Marks issues that should be documented in the release notes of the next release. label Oct 4, 2021

rfcbot added proposed-final-comment-period Proposed to merge/close by relevant subteam, see T-<team> label. Will enter FCP once signed off. disposition-merge This issue / PR is in PFCP or FCP with a disposition to merge it. labels Oct 4, 2021

bors added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Nov 17, 2021

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Nov 18, 2021

bors added the merged-by-bors This PR was explicitly merged by bors. label Nov 20, 2021

bors merged commit 2885c47 into rust-lang:master Nov 20, 2021

rustbot added this to the 1.58.0 milestone Nov 20, 2021

ChrisDenton deleted the win-resolve-exe branch November 24, 2021 08:52

ChrisDenton mentioned this pull request Nov 24, 2021

Maintain broken symlink behaviour for the Windows exe resolver #91182

Merged

This was referenced Dec 2, 2021

Command::spawn has weird rules for finding binaries on Windows #37519

Open

std::process::Command accepting arbitrary file extensions when env() specified #50870

Closed

ChrisDenton mentioned this pull request Jan 3, 2022

Use verbatim paths for process::Command if necessary #92519

Merged

Urgau mentioned this pull request Feb 8, 2022

Win32 Alternate data streams don't work with Command in Rust 1.58.0 #93772

Closed

This was referenced Nov 13, 2022

std::process::Command on Windows does not correctly find the program executable #104358

Closed

There is no documentation on what "executing a recipe as a script" means casey/just#1410

Closed

ehuss mentioned this pull request Dec 29, 2022

no such subcommand: +<toolchain> rust-lang/cargo-bisect-rustc#244

Closed

kzys mentioned this pull request Jun 13, 2023

use full paths when calling exec command superfly/flyctl#2437

Merged

gyk mentioned this pull request Nov 29, 2023

Support building with ImageMagick from MSYS2 nlfiedler/magick-rust#114

Merged

EliahKagan mentioned this pull request Jun 29, 2024

ssh clone does not correctly detect the location of ssh.exe GitoxideLabs/gitoxide#1432

Closed

EliahKagan mentioned this pull request Aug 29, 2024

Tests on Windows must usually be run in Git Bash or a similar environment GitoxideLabs/gitoxide#1359

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Windows: Resolve `process::Command` program without using the current directory #87704

Windows: Resolve `process::Command` program without using the current directory #87704

ChrisDenton commented Aug 2, 2021 •

edited

Loading

rust-highfive commented Aug 2, 2021

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

bors commented Aug 12, 2021

ChrisDenton commented Aug 14, 2021 •

edited

Loading

dtolnay commented Aug 14, 2021

rustbot commented Aug 14, 2021

bk2204 commented Aug 14, 2021 •

edited

Loading

ChrisDenton commented Aug 14, 2021

bk2204 commented Aug 14, 2021

bors commented Aug 20, 2021

joshtriplett commented Oct 4, 2021

rfcbot commented Oct 4, 2021 •

edited by yaahc

Loading

ChrisDenton commented Nov 18, 2021

Amanieu commented Nov 18, 2021

bors commented Nov 20, 2021

bors commented Nov 20, 2021

rust-timer commented Nov 20, 2021

Windows: Resolve process::Command program without using the current directory #87704

Windows: Resolve process::Command program without using the current directory #87704

Conversation

ChrisDenton commented Aug 2, 2021 • edited Loading

Old Search Strategy

New Search Strategy

Impact

rust-highfive commented Aug 2, 2021

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

bors commented Aug 12, 2021

ChrisDenton commented Aug 14, 2021 • edited Loading

dtolnay commented Aug 14, 2021

rustbot commented Aug 14, 2021

bk2204 commented Aug 14, 2021 • edited Loading

ChrisDenton commented Aug 14, 2021

bk2204 commented Aug 14, 2021

bors commented Aug 20, 2021

joshtriplett commented Oct 4, 2021

rfcbot commented Oct 4, 2021 • edited by yaahc Loading

ChrisDenton commented Nov 18, 2021

Amanieu commented Nov 18, 2021

bors commented Nov 20, 2021

bors commented Nov 20, 2021

rust-timer commented Nov 20, 2021

Windows: Resolve `process::Command` program without using the current directory #87704

Windows: Resolve `process::Command` program without using the current directory #87704

ChrisDenton commented Aug 2, 2021 •

edited

Loading

ChrisDenton commented Aug 14, 2021 •

edited

Loading

bk2204 commented Aug 14, 2021 •

edited

Loading

rfcbot commented Oct 4, 2021 •

edited by yaahc

Loading