Shell extension uses unquoted program path

[AnandBhat]

After reading https://isc.sans.edu/diary/Help+elimina ... ties/14464, I noticed an unquoted path vulnerability in the WinMerge shell extension feature. I tried the latest Alpha release (2.13.21 alpha) and the issue continues to be present. Can you please have this addressed in your next release?

Steps to reproduce the issue:
1. Install WinMerge in the default location (C:\Program Files\WinMerge) and enable shell extensions.
2. Create a copy of calc.exe and place it as C:\program.exe
3. Attempt to use the shell extension (either Compare or Compare As... after selecting two files or directories).
4. The copy of calc.exe opens up instead of WinMerge, indicating the the shell extension tried to invoke WinMerge using an unquoted command path.

Let me know if you need any other details.

[jtuc]

https://bitbucket.org/jtuc/winmerge2011/commits/27e4020a68db3872b2c8ce5e7c3749e39482b705

Thanks for reporting.

[AnandBhat]

Thanks!

[christianlist]

This particular bug is now fixed in WinMerge 2.14.0

But I left my copy of Calc.exe at C:\Program.exe and noticed another bug:
When WinMerge is launched from TortoiseSVN it too uses unquoted paths.
It turns out that our installer integration with TortoiseSVN (and possible the other integrations too) is adding the integration using an unquoted path.

[ethan3]

After reading https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464, I noticed an unquoted path vulnerability in the WinMerge shell extension feature. I tried the latest Alpha release (2.13.21 alpha) and the issue continues to be present. Can you please have this addressed in your next release?

Steps to reproduce the issue:
1. Install WinMerge in the default location (C:\Program Files\WinMerge) and enable shell extensions.
2. Create a copy of calc.exe and place it as C:\program.exe
3. Attempt to use the shell extension (either Compare or Compare As... after selecting two files or directories).
4. The copy of calc.exe opens up instead of WinMerge, indicating the the shell extension tried to invoke WinMerge using an unquoted command path.

Let me know if you need any other details.

I am using WinMerge Portable 2.14.0 without any bugs. It is included full support for archives with the bundled 7-Zip plugin.