* threadproc/win32/proc.c
(apr_proc_create): Remove compatibility code for command.com which is only
available on Windows 98 and bellow.
@@ -518,16 +518,9 @@ APR_DECLARE(apr_status_t) apr_proc_create(apr_proc_t *new,
shellcmd = apr_pstrcat(pool, "\"", shellcmd, "\"", NULL);
}
}
- /* Command.com does not support a quoted command, while cmd.exe demands one.
- */
- i = strlen(progname);
- if (i >= 11 && strcasecmp(progname + i - 11, "command.com") == 0) {
- cmdline = apr_pstrcat(pool, shellcmd, " /C ", argv0, cmdline, NULL);
- }
- else {
+
cmdline = apr_pstrcat(pool, shellcmd, " /C \"", argv0, cmdline, "\"", NULL);
}
- }
else
{
/* Win32 is _different_ than unix. While unix will find the given
@@ -556,16 +549,7 @@ APR_DECLARE(apr_status_t) apr_proc_create(apr_proc_t *new,
shellcmd = apr_pstrcat(pool, "\"", shellcmd, "\"", NULL);
}
}
- i = strlen(progname);
- if (i >= 11 && strcasecmp(progname + i - 11, "command.com") == 0) {
- /* XXX: Still insecure - need doubled-quotes on each individual
- * arg of cmdline. Suspect we need to postpone cmdline parsing
- * until this moment in all four code paths, with some flags
- * to toggle 'which flavor' is needed.
- */
- cmdline = apr_pstrcat(pool, shellcmd, " /C ", argv0, cmdline, NULL);
- }
- else {
+
/* We must protect the cmdline args from any interpolation - this
* is not a shellcmd, and the source of argv[] is untrusted.
* Notice we escape ALL the cmdline args, including the quotes
@@ -585,7 +569,6 @@ APR_DECLARE(apr_status_t) apr_proc_create(apr_proc_t *new,
cmdline = apr_pstrcat(pool, shellcmd, " /C \"", argv0, cmdline, "\"", NULL);
}
}
- }
else {
/* A simple command we are directly invoking. Do not pass
* the first arg to CreateProc() for APR_PROGRAM_PATH
