Subject: Re: bug#19350: #19350 24.4; Incorrect quoting of %-signs for Windows command shell

From: Demi Obenour <[email-masked]>
Date: Wed, 17 Aug 2016 22:02:55 -0400

But *nix has no such feature, nor the associated gotcha.

On Aug 15, 2016 11:01 AM, "Eli Zaretskii" <[email-masked]> wrote:

> > From: [email-masked]
> > Date: Sun, 14 Aug 2016 23:13:43 -0400
> > Cc: [email-masked]
> >
> > Hmm, maybe we could fix this by making Emacs refuse to apply environment
> > variables with names ending in carets?
>
> I'm very much against disallowing perfectly valid (if rare) use cases
> just because someone malicious can take advantage of that.
>
> From my POV, as long as Emacs itself doesn't produce such shell
> commands and/or environment variables for any of its features,
> avoiding this becomes user's responsibility, just like when working at
> the shell prompt.  Of course, if we can find a reliable solution to
> the problem that doesn't take away features, that'd be better, but
> failing that, I'm okay with leaving this alone, perhaps documenting
> somewhere that using % in shell commands when there are environment
> variables ending in ^ could produce surprising results.
>
> Thanks.
>