Windows: Consider disallowing `.bat` and `.cmd` files in `Command::new` about rust HOT 6 CLOSED

I think we definitely do need to flesh out our documentation. But I'd also like to explicitly decide what our behaviour should be rather than just documenting behaviour which is mostly accidental. Even if that decision ends up being to keep doing what we're currently doing, I'd rather that was a conscious choice.

from rust.

Rust's std does not use PATHEXT and nor does the underlying CreateProcess API. I did once make an issue about Command running scripts but most felt this was better done in a crate (see #94743)

from rust.

https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ says:

However, since Windows includes .bat and .cmd files in the PATHEXT environment variable by default, some runtimes execute batch files against the developers’ intention if there is a batch file with the same name as the command that the developer intended to execute

does libstd ignore PATHEXT? or is it possible that Command::new("script") could have the same effect as Command::new("script.bat")? in the latter case i don't see much point in disallowing .bat specifically (although it might be reasonable for clippy to lint on it).

from rust.

FWIW, I was previously confused about PATHEXT too: #50870 (comment)

Other relevant issues for cross reference: #37519 #87945 #93124

from rust.

This was discussed in the libs-api meeting. There was no consensus on dropping this behaviour.

However there's also not currently a consensus on documenting this behaviour, rather than just keeping some degree of hidden support for compatibility reasons but not actively advertising it (maybe with a lint on static strings passed to Command::new that contain .bat or .cmd extensions).

from rust.

This was again discussed in the latest libs-api meeting. It was felt that keeping our current behaviour was worth it for the sake of compatibility. So I'll close this.

I'll add that our documentation does now have warnings around bat use. Improved documentation for Windows specific issues can of course be added but that's a separate issue.

from rust.