Dropped file paths are quoted for cmd.exe even in a PowerShell pane, allowing subexpression execution

[nedtwigg]

Found by the nightly security audit's application-security pass (see SECURITY.md → CI Validation Contract), verified by hand.

What happens

shellEscapePath picks its quoting rule from the host platform, never from the shell running in the target pane:

https://github.com/diffplug/dormouse/blob/main/lib/src/lib/shell-escape.ts#L27-L29

export function shellEscapePath(input: string): string {
  return !IS_MAC && IS_WINDOWS ? shellEscapeWindows(input) : shellEscapePosix(input);
}

shellEscapeWindows wraps the path in double quotes and doubles any embedded ". That is correct for cmd.exe, which does no expansion inside double quotes. It is not correct for PowerShell, where a double-quoted string is expandable: $(...) runs a subexpression and $name interpolates.

So on Windows, dropping (or pasting) a file named

$(calc.exe).txt

into a PowerShell pane stages the line

"$(calc.exe).txt"

and the subexpression runs as soon as the user presses Enter — which they have every reason to do, since they just dropped a file in to use its path. The single caller is the drop/paste path:

https://github.com/diffplug/dormouse/blob/main/lib/src/lib/clipboard.ts#L66

const text = paths.map(shellEscapePath).join(' ') + ' ';

Severity

Low-to-moderate. It needs a Windows host, a PowerShell pane, and a file whose name the attacker controls — an unzipped archive, a shared folder, a download. Nothing is executed without the user pressing Enter. But the whole point of drag-and-drop is that the resulting line looks like an ordinary path and gets run without inspection, and a filename is exactly the kind of thing users treat as inert data.

The fix already exists one package over

dor quotes per target shell rather than per host platform, and gets PowerShell right:

https://github.com/diffplug/dormouse/blob/main/dor/src/commands/shell-quote.ts#L13-L21

The work is threading the pane's shell identity to the call site in clipboard.ts and reusing that logic instead of shellEscapePath's platform branch. Worth checking whether anything else infers a shell from process.platform.

docs/specs/mouse-and-clipboard.md owns this behavior and should be updated with the fix — it currently describes the escaping without noting that it assumes the host's default shell.

[dormouse-bot]

Reproduced and fixed in #432.

Confirmed the mechanism as reported: five new cases in shell-escape.test.ts failed against main, the reported one as expected '"$(calc.exe).txt"' to be ''$(calc.exe).txt''. The fix threads the shell identity the way you described — shellEscapePath now classifies with dor's shellCommandKind and dispatches posix / cmd / PowerShell, reusing quotePowerShellArg for the last. The app-global selected shell stands in for the pane's shell (same stand-in dorCommandString already makes, since shell isn't tracked per-session), and an unset shell still falls back to the host platform, so cmd panes and every posix host keep their current escaping byte-for-byte.

Two things worth flagging beyond the PowerShell case:

• Git Bash and WSL panes on Windows had the same mismatch, just without the execution: they parse posix quoting and were handed cmd quoting. The shell-kind dispatch fixes both in one move, which is why the fix is per-shell rather than a PowerShell special case.
• quoteCmdArg is deliberately not reused for the cmd branch. It ^-escapes &|<>()^" and then wraps in double quotes, but ^ is literal inside cmd's double quotes — so $(calc.exe).txt would come back as "$^(calc.exe^).txt", a corrupted path. shellEscapeWindows's plain wrapping stays. That's adjacent to quoteCmdArg corrupts arguments containing a literal " on cmd surfaces #162 but a different defect in the same function, so I left it alone.

Nothing else infers a shell from the platform — the remaining IS_WINDOWS reads (win32-input-mode, the updater's sidecar kill) are genuinely about the host.

docs/specs/mouse-and-clipboard.md §8.6 now carries the per-shell escaping rules; dor-cli.md cross-links to them from its quoting section, since both paths go through the one classifier now.

Verification

• lib suite: 1676 passed / 125 files. dor suite: 100 passed. tsc -b clean, spec-lint OK, Pocket bundle builds (the dor alias reaches it via Wall → useDorControl already).
• PR CI on 45fb9be: Build & Test, Visual Regression Tests, Standalone Smoketest, both Standalone Platform Checks, Storybook Publish, Cloudflare Pages all green. Chromatic UI Tests sits pending with "2 changes must be accepted as baselines" — the diff touches no components, so that wants a look before it's accepted.