Skip to content

Use native command lookup for pagers - #3986

Open
Matei02355 wants to merge 2 commits into
sharkdp:masterfrom
Matei02355:standard-pager-resolution-2027-20260907
Open

Use native command lookup for pagers#3986
Matei02355 wants to merge 2 commits into
sharkdp:masterfrom
Matei02355:standard-pager-resolution-2027-20260907

Conversation

@Matei02355

Copy link
Copy Markdown
Contributor

Rust 1.58 removed implicit working-directory searches when launching Windows programs. The project's existing rust-version = 1.88 already enforces a sufficiently recent compiler, so retire the grep-cli executable-resolution workaround and its dependency.

Construct pager and version-query commands with std::process::Command. Keep the existing stdout fallback when launching a pager fails. On Windows, native lookup appends .exe but does not try .com, so retry an extensionless program with .com only after NotFound; this preserves bare more/custom COM pager support. Explicit extensions and non-NotFound launch errors never trigger that retry. Native executable lookup now takes precedence, with COM programs as a fallback. Diagnostics also use native command lookup.

Fixes #2027.

Validation: 474 tests passed locally with all features; seven platform/manual tests were ignored. All-target/all-feature Clippy, formatting and the minimal regex-onig library build passed. New Windows CI tests exercise a malicious pager in the working directory, PATH lookup for EXE and COM programs, explicit relative/absolute paths containing spaces, explicit-extension failures, version queries through a batch path, and rejection of retries after other launch errors. Windows-specific tests require the Windows CI runners and have not been executed locally.

Rust behavior: https://blog.rust-lang.org/2022/01/13/Rust-1.58.0/

@Matei02355
Matei02355 marked this pull request as ready for review September 7, 2026 16:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rust 1.58 solves command execution vulnerability

1 participant