# HG changeset patch # User avoitylov # Date 1612387963 -10800 # Node ID b423d9afa01f5a0a2912cbf5bb20b1d81d0e9d01 # Parent 412d2b1381a44b0a247bd67df9f35530b275d9a5 8250568: Less ambiguous processing Reviewed-by: mbalao, andrew diff -r 412d2b1381a4 -r b423d9afa01f src/windows/classes/java/lang/ProcessImpl.java --- a/src/windows/classes/java/lang/ProcessImpl.java Wed Apr 07 05:57:56 2021 +0100 +++ b/src/windows/classes/java/lang/ProcessImpl.java Thu Feb 04 00:32:43 2021 +0300 @@ -181,9 +181,9 @@ private static final char ESCAPE_VERIFICATION[][] = { // We guarantee the only command file execution for implicit [cmd.exe] run. // http://technet.microsoft.com/en-us/library/bb490954.aspx - {' ', '\t', '<', '>', '&', '|', '^'}, - {' ', '\t', '<', '>'}, - {' ', '\t', '<', '>'}, + {' ', '\t', '\"', '<', '>', '&', '|', '^'}, + {' ', '\t', '\"', '<', '>'}, + {' ', '\t', '\"', '<', '>'}, {' ', '\t'} }; @@ -243,18 +243,27 @@ } /** - * Return the argument without quotes (1st and last) if present, else the arg. + * Return the argument without quotes (1st and last) if properly quoted, else the arg. + * A properly quoted string has first and last characters as quote and + * the last quote is not escaped. * @param str a string - * @return the string without 1st and last quotes + * @return the string without quotes */ private static String unQuote(String str) { - int len = str.length(); - return (len >= 2 && str.charAt(0) == DOUBLEQUOTE && str.charAt(len - 1) == DOUBLEQUOTE) - ? str.substring(1, len - 1) - : str; + if (!str.startsWith("\"") || !str.endsWith("\"") || str.length() < 2) + return str; // no beginning or ending quote, or too short not quoted + + if (str.endsWith("\\\"")) { + return str; // not properly quoted, treat as unquoted + } + // Strip leading and trailing quotes + return str.substring(1, str.length() - 1); } private static boolean needsEscaping(int verificationType, String arg) { + if (arg.isEmpty()) + return true; // Empty string is to be quoted + // Switch off MS heuristic for internal ["]. // Please, use the explicit [cmd.exe] call // if you need the internal ["].