cygrunsrv CWE-428

[James Warnock]

We use cygwin including installing some services via cygrunsrv. We have had some users run vulnerability scans which flag the installed services due to an unquoted service path (CWE-428 [1]). I haven't been able to find any discussion of this in the archives except for the "cygrunsrv -L outputs nothing if service paths are quoted" [2]. In that message, another user manually added quotes to resolve the vulnerability scan but then 'cygrunsrv -L' no longer listed installed services. That issue was fixed.

I did come up with a simple patch (attached) that worked for my limited use case. But there may be considerations for global usage of which I am unaware.

Should cygrunsrv be updated to automatically include the quotes?

Thanks,
James

[1] https://cwe.mitre.org/data/definitions/428.html
[2] https://cygwin.com/pipermail/cygwin/2023-February/252998.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: cwe-428.patch
Type: text/x-patch
Size: 1951 bytes
Desc: cwe-428.patch
URL: <https://cygwin.com/pipermail/cygwin/attachments/20260420/26ecd50c/attachment-0001.bin>