cygrunsrv CWE-428

[James Warnock]

We use cygwin including installing some services via cygrunsrv. We have 
had some users run vulnerability scans which flag the installed services 
due to an unquoted service path (CWE-428 [1]). I haven't been able to 
find any discussion of this in the archives except for the "cygrunsrv -L 
outputs nothing if service paths are quoted" [2]. In that message, 
another user manually added quotes to resolve the vulnerability scan but 
then 'cygrunsrv -L' no longer listed installed services. That issue was 
fixed.

I did come up with a simple patch (attached) that worked for my limited 
use case. But there may be considerations for global usage of which I am 
unaware.

Should cygrunsrv be updated to automatically include the quotes?

Thanks,
James

[1] https://cwe.mitre.org/data/definitions/428.html
[2] https://cygwin.com/pipermail/cygwin/2023-February/252998.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: cwe-428.patch
Type: text/x-patch
Size: 1951 bytes
Desc: not available
URL: <https://cygwin.com/pipermail/cygwin/attachments/20260421/b37ae347/attachment.bin>