Tcl Source Code

[UPDATED]<br/>
0-day vulnerability in tcl-exec (for win) by calling of batch-files resp. default windows command processor.
<code><pre style="padding-left:10pt">
% exec my-echo.cmd {test &whoami} 
<b style="color:green">  "test &whoami"</b>
% exec my-echo.cmd {test"&whoami} 
<b style="color:green">  test\"&whoami</b>
% exec my-echo.cmd {test&whoami}
<b style="color:red">  test
  my_domain\sebres</b>
</pre></code>
It may be expected in the direct invocation of <code>cmd.exe /c ...</code> as regards it accepts many special meta-chars (so some pre-processing on the part of command-processor may be required).
But the same pre-processing by invocation of the batch-files is very dangerous, so is unwanted as vulnerable.

Rather it is a matter the weird windows unescape behavior in case of command processor,<br/>therefore almost everything else beside Tcl is affected by same vulnerability also similar way.

For example python (for win):
<code><pre style="padding-left:10pt">
>>> subprocess.call(['my-echo.cmd', 'test &whoami'])
<b style="color:green">  "test &whoami"</b>
>>> subprocess.call(['my-echo.cmd', 'test"&whoami'])
<b style="color:green">  test\"&whoami</b>
>>> subprocess.call(['my-echo.cmd', 'test&whoami'])
<b style="color:red">  test
  my_domain\sebres</b>
</pre></code>

See [https://github.com/sebres/PoC/blob/master/SB-0D-001-win-exec/README.md|github.com/sebres/PoC/SB-0D-001-win-exec] for more extensive PoC with additional info (and more lang's).

Thanks to Peter (resuna) for link to <a href="https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/">discussion</a>

It looks like the arguments containing unpaired quote-chars somewhere will cause processing of the special meta-characters, so it should be extra escaped using tripple circumflex but only for unpaired quote-chars (by paired quotes it remains the meta-char as well as <code>^^^</code> sequence).

For more extensive PoC I wrote a small helper dumping arguments (here <code>test-dump.exe</code>) as well as small batch (<code>test-dump.cmd</code>) doing the same:
<code><pre style="padding-left:10pt">
@pushd %~dp0
@rem echo %*
@test-dump.exe %*
@popd
</pre></code>

Instead of test-dump.exe one can use following code as <code>test-dump.tcl</code> (with adjusting the invocation in <code>test-dump.cmd</code>)
<code><pre style="padding-left:10pt">
catch { puts -nonewline "    `[file tail $::argv0]´ `[join $::argv "´ `"]´"; flush stdout }
</pre></code>

And use following tcl-script (<code>test-dump-inv.tcl</code>) to try or validate different variants (to find the "injuries"):
<code><pre style="padding-left:10pt">
set testinv {test-dump.exe test-dump.CMD}

set tn 0
foreach a {
  {test"whoami}     {test""whoami}
  {test&whoami}     {test|whoami}
  {"test&whoami}    {"test|whoami}
  {test"&whoami}    {test"|whoami}
  {"test"&whoami}   {"test"|whoami}
  {""test"&whoami}  {""test"|whoami}
  {test&echo "}     {test|echo "}
  {"test&echo "}    {"test|echo "}
  {test"&echo "}    {test"|echo "}
  {"test"&echo "}   {"test"|echo "}
  {""test"&echo "}  {""test"|echo "}
  {test&echo ""}    {test|echo ""}
  {"test&echo ""}   {"test|echo ""}
  {test"&echo ""}   {test"|echo ""}
  {"test"&echo ""}  {"test"|echo ""}
  {""test"&echo ""} {""test"|echo ""}
  {test>whoami}     {test<whoami}
  {"test>whoami}    {"test<whoami}
  {test">whoami}    {test"<whoami}
  {"test">whoami}   {"test"<whoami}
  {""test">whoami}  {""test"<whoami}
  {test(whoami)}    {test(whoami)}
  {test"(whoami)}   {test"(whoami)}
  {test^whoami}     {test^^echo ^^^}
  {test"^whoami}    {test"^^echo ^^^}
} {
  puts [string repeat - 20]
  unset -nocomplain prevr
  foreach cmd $testinv {
    puts -nonewline [format "*%3d) `%s´" \
      $tn [join [list test-dump[file extension [lindex $cmd 0]] $a] "´ `"]]
    if {[catch {
      set r [exec {*}$cmd $a]
    } r]} {
      set r "ERROR: $r"
    }
    if {![info exists prevr] || $prevr eq $r} {
      puts ""
    } else {
      puts " -- *VULNERABLE*"
    }
    set prevr $r
    puts [regsub -all -line {^} $r "  "]
  }
  incr tn
}
</pre></code>

The results:
<code><pre style="padding-left:10pt">
> tclsh.exe test-dump-inv.tcl
--------------------
<b style="color:blue">*  0) `test-dump.exe´ `test"whoami´</b>
      `test-dump.exe´ `test"whoami´
<b style="color:blue">*  0) `test-dump.CMD´ `test"whoami´</b>
      `test-dump.exe´ `test"whoami´
--------------------
<b style="color:blue">*  1) `test-dump.exe´ `test""whoami´</b>
      `test-dump.exe´ `test""whoami´
<b style="color:blue">*  1) `test-dump.CMD´ `test""whoami´</b>
      `test-dump.exe´ `test""whoami´
--------------------
<b style="color:blue">*  2) `test-dump.exe´ `test&whoami´</b>
      `test-dump.exe´ `test&whoami´
<b style="color:blue">*  2) `test-dump.CMD´ `test&whoami´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `test´my_domain\sebres
</b>--------------------
<b style="color:blue">*  3) `test-dump.exe´ `test|whoami´</b>
      `test-dump.exe´ `test|whoami´
<b style="color:blue">*  3) `test-dump.CMD´ `test|whoami´</b> -- <b style="color:red">*VULNERABLE*
  my_domain\sebres
</b>--------------------
<b style="color:blue">*  4) `test-dump.exe´ `"test&whoami´</b>
      `test-dump.exe´ `"test&whoami´
<b style="color:blue">*  4) `test-dump.CMD´ `"test&whoami´</b>
      `test-dump.exe´ `"test&whoami´
--------------------
<b style="color:blue">*  5) `test-dump.exe´ `"test|whoami´</b>
      `test-dump.exe´ `"test|whoami´
<b style="color:blue">*  5) `test-dump.CMD´ `"test|whoami´</b>
      `test-dump.exe´ `"test|whoami´
--------------------
<b style="color:blue">*  6) `test-dump.exe´ `test"&whoami´</b>
      `test-dump.exe´ `test"&whoami´
<b style="color:blue">*  6) `test-dump.CMD´ `test"&whoami´</b>
      `test-dump.exe´ `test"&whoami´
--------------------
<b style="color:blue">*  7) `test-dump.exe´ `test"|whoami´</b>
      `test-dump.exe´ `test"|whoami´
<b style="color:blue">*  7) `test-dump.CMD´ `test"|whoami´</b>
      `test-dump.exe´ `test"|whoami´
--------------------
<b style="color:blue">*  8) `test-dump.exe´ `"test"&whoami´</b>
      `test-dump.exe´ `"test"&whoami´
<b style="color:blue">*  8) `test-dump.CMD´ `"test"&whoami´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `"test"´my_domain\sebres
</b>--------------------
<b style="color:blue">*  9) `test-dump.exe´ `"test"|whoami´</b>
      `test-dump.exe´ `"test"|whoami´
<b style="color:blue">*  9) `test-dump.CMD´ `"test"|whoami´</b> -- <b style="color:red">*VULNERABLE*
  my_domain\sebres
</b>--------------------
<b style="color:blue">* 10) `test-dump.exe´ `""test"&whoami´</b>
      `test-dump.exe´ `""test"&whoami´
<b style="color:blue">* 10) `test-dump.CMD´ `""test"&whoami´</b>
      `test-dump.exe´ `""test"&whoami´
--------------------
<b style="color:blue">* 11) `test-dump.exe´ `""test"|whoami´</b>
      `test-dump.exe´ `""test"|whoami´
<b style="color:blue">* 11) `test-dump.CMD´ `""test"|whoami´</b>
      `test-dump.exe´ `""test"|whoami´
--------------------
<b style="color:blue">* 12) `test-dump.exe´ `test&echo "´</b>
      `test-dump.exe´ `test&echo "´
<b style="color:blue">* 12) `test-dump.CMD´ `test&echo "´</b>
      `test-dump.exe´ `test&echo "´
--------------------
<b style="color:blue">* 13) `test-dump.exe´ `test|echo "´</b>
      `test-dump.exe´ `test|echo "´
<b style="color:blue">* 13) `test-dump.CMD´ `test|echo "´</b>
      `test-dump.exe´ `test|echo "´
--------------------
<b style="color:blue">* 14) `test-dump.exe´ `"test&echo "´</b>
      `test-dump.exe´ `"test&echo "´
<b style="color:blue">* 14) `test-dump.CMD´ `"test&echo "´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `"test´\""
</b>--------------------
<b style="color:blue">* 15) `test-dump.exe´ `"test|echo "´</b>
      `test-dump.exe´ `"test|echo "´
<b style="color:blue">* 15) `test-dump.CMD´ `"test|echo "´</b> -- <b style="color:red">*VULNERABLE*
  \""
</b>--------------------
<b style="color:blue">* 16) `test-dump.exe´ `test"&echo "´</b>
      `test-dump.exe´ `test"&echo "´
<b style="color:blue">* 16) `test-dump.CMD´ `test"&echo "´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `test"´\""
</b>--------------------
<b style="color:blue">* 17) `test-dump.exe´ `test"|echo "´</b>
      `test-dump.exe´ `test"|echo "´
<b style="color:blue">* 17) `test-dump.CMD´ `test"|echo "´</b> -- <b style="color:red">*VULNERABLE*
  \""
</b>--------------------
<b style="color:blue">* 18) `test-dump.exe´ `"test"&echo "´</b>
      `test-dump.exe´ `"test"&echo "´
<b style="color:blue">* 18) `test-dump.CMD´ `"test"&echo "´</b>
      `test-dump.exe´ `"test"&echo "´
--------------------
<b style="color:blue">* 19) `test-dump.exe´ `"test"|echo "´</b>
      `test-dump.exe´ `"test"|echo "´
<b style="color:blue">* 19) `test-dump.CMD´ `"test"|echo "´</b>
      `test-dump.exe´ `"test"|echo "´
--------------------
<b style="color:blue">* 20) `test-dump.exe´ `""test"&echo "´</b>
      `test-dump.exe´ `""test"&echo "´
<b style="color:blue">* 20) `test-dump.CMD´ `""test"&echo "´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `""test"´\""
</b>--------------------
<b style="color:blue">* 21) `test-dump.exe´ `""test"|echo "´</b>
      `test-dump.exe´ `""test"|echo "´
<b style="color:blue">* 21) `test-dump.CMD´ `""test"|echo "´</b> -- <b style="color:red">*VULNERABLE*
  \""
</b>--------------------
<b style="color:blue">* 22) `test-dump.exe´ `test&echo ""´</b>
      `test-dump.exe´ `test&echo ""´
<b style="color:blue">* 22) `test-dump.CMD´ `test&echo ""´</b>
      `test-dump.exe´ `test&echo ""´
--------------------
<b style="color:blue">* 23) `test-dump.exe´ `test|echo ""´</b>
      `test-dump.exe´ `test|echo ""´
<b style="color:blue">* 23) `test-dump.CMD´ `test|echo ""´</b>
      `test-dump.exe´ `test|echo ""´
--------------------
<b style="color:blue">* 24) `test-dump.exe´ `"test&echo ""´</b>
      `test-dump.exe´ `"test&echo ""´
<b style="color:blue">* 24) `test-dump.CMD´ `"test&echo ""´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `"test´\"\""
</b>--------------------
<b style="color:blue">* 25) `test-dump.exe´ `"test|echo ""´</b>
      `test-dump.exe´ `"test|echo ""´
<b style="color:blue">* 25) `test-dump.CMD´ `"test|echo ""´</b> -- <b style="color:red">*VULNERABLE*
  \"\""
</b>--------------------
<b style="color:blue">* 26) `test-dump.exe´ `test"&echo ""´</b>
      `test-dump.exe´ `test"&echo ""´
<b style="color:blue">* 26) `test-dump.CMD´ `test"&echo ""´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `test"´\"\""
</b>--------------------
<b style="color:blue">* 27) `test-dump.exe´ `test"|echo ""´</b>
      `test-dump.exe´ `test"|echo ""´
<b style="color:blue">* 27) `test-dump.CMD´ `test"|echo ""´</b> -- <b style="color:red">*VULNERABLE*
  \"\""
</b>--------------------
<b style="color:blue">* 28) `test-dump.exe´ `"test"&echo ""´</b>
      `test-dump.exe´ `"test"&echo ""´
<b style="color:blue">* 28) `test-dump.CMD´ `"test"&echo ""´</b>
      `test-dump.exe´ `"test"&echo ""´
--------------------
<b style="color:blue">* 29) `test-dump.exe´ `"test"|echo ""´</b>
      `test-dump.exe´ `"test"|echo ""´
<b style="color:blue">* 29) `test-dump.CMD´ `"test"|echo ""´</b>
      `test-dump.exe´ `"test"|echo ""´
--------------------
<b style="color:blue">* 30) `test-dump.exe´ `""test"&echo ""´</b>
      `test-dump.exe´ `""test"&echo ""´
<b style="color:blue">* 30) `test-dump.CMD´ `""test"&echo ""´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `""test"´\"\""
</b>--------------------
<b style="color:blue">* 31) `test-dump.exe´ `""test"|echo ""´</b>
      `test-dump.exe´ `""test"|echo ""´
<b style="color:blue">* 31) `test-dump.CMD´ `""test"|echo ""´</b> -- <b style="color:red">*VULNERABLE*
  \"\""
</b>--------------------
<b style="color:blue">* 32) `test-dump.exe´ `test>whoami´</b>
      `test-dump.exe´ `test>whoami´
<b style="color:blue">* 32) `test-dump.CMD´ `test>whoami´</b> -- <b style="color:red">*VULNERABLE*

</b>--------------------
<b style="color:blue">* 33) `test-dump.exe´ `test<whoami´</b>
      `test-dump.exe´ `test<whoami´
<b style="color:blue">* 33) `test-dump.CMD´ `test<whoami´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `test´
</b>--------------------
<b style="color:blue">* 34) `test-dump.exe´ `"test>whoami´</b>
      `test-dump.exe´ `"test>whoami´
<b style="color:blue">* 34) `test-dump.CMD´ `"test>whoami´</b>
      `test-dump.exe´ `"test>whoami´
--------------------
<b style="color:blue">* 35) `test-dump.exe´ `"test<whoami´</b>
      `test-dump.exe´ `"test<whoami´
<b style="color:blue">* 35) `test-dump.CMD´ `"test<whoami´</b>
      `test-dump.exe´ `"test<whoami´
--------------------
<b style="color:blue">* 36) `test-dump.exe´ `test">whoami´</b>
      `test-dump.exe´ `test">whoami´
<b style="color:blue">* 36) `test-dump.CMD´ `test">whoami´</b>
      `test-dump.exe´ `test">whoami´
--------------------
<b style="color:blue">* 37) `test-dump.exe´ `test"<whoami´</b>
      `test-dump.exe´ `test"<whoami´
<b style="color:blue">* 37) `test-dump.CMD´ `test"<whoami´</b>
      `test-dump.exe´ `test"<whoami´
--------------------
<b style="color:blue">* 38) `test-dump.exe´ `"test">whoami´</b>
      `test-dump.exe´ `"test">whoami´
<b style="color:blue">* 38) `test-dump.CMD´ `"test">whoami´</b> -- <b style="color:red">*VULNERABLE*

</b>--------------------
<b style="color:blue">* 39) `test-dump.exe´ `"test"<whoami´</b>
      `test-dump.exe´ `"test"<whoami´
<b style="color:blue">* 39) `test-dump.CMD´ `"test"<whoami´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `"test"´
</b>--------------------
<b style="color:blue">* 40) `test-dump.exe´ `""test">whoami´</b>
      `test-dump.exe´ `""test">whoami´
<b style="color:blue">* 40) `test-dump.CMD´ `""test">whoami´</b>
      `test-dump.exe´ `""test">whoami´
--------------------
<b style="color:blue">* 41) `test-dump.exe´ `""test"<whoami´</b>
      `test-dump.exe´ `""test"<whoami´
<b style="color:blue">* 41) `test-dump.CMD´ `""test"<whoami´</b>
      `test-dump.exe´ `""test"<whoami´
--------------------
<b style="color:blue">* 42) `test-dump.exe´ `test(whoami)´</b>
      `test-dump.exe´ `test(whoami)´
<b style="color:blue">* 42) `test-dump.CMD´ `test(whoami)´</b>
      `test-dump.exe´ `test(whoami)´
--------------------
<b style="color:blue">* 43) `test-dump.exe´ `test(whoami)´</b>
      `test-dump.exe´ `test(whoami)´
<b style="color:blue">* 43) `test-dump.CMD´ `test(whoami)´</b>
      `test-dump.exe´ `test(whoami)´
--------------------
<b style="color:blue">* 44) `test-dump.exe´ `test"(whoami)´</b>
      `test-dump.exe´ `test"(whoami)´
<b style="color:blue">* 44) `test-dump.CMD´ `test"(whoami)´</b>
      `test-dump.exe´ `test"(whoami)´
--------------------
<b style="color:blue">* 45) `test-dump.exe´ `test"(whoami)´</b>
      `test-dump.exe´ `test"(whoami)´
<b style="color:blue">* 45) `test-dump.CMD´ `test"(whoami)´</b>
      `test-dump.exe´ `test"(whoami)´
--------------------
<b style="color:blue">* 46) `test-dump.exe´ `test^whoami´</b>
      `test-dump.exe´ `test^whoami´
<b style="color:blue">* 46) `test-dump.CMD´ `test^whoami´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `testwhoami´
</b>--------------------
<b style="color:blue">* 47) `test-dump.exe´ `test^^echo ^^^´</b>
      `test-dump.exe´ `test^^echo ^^^´
<b style="color:blue">* 47) `test-dump.CMD´ `test^^echo ^^^´</b>
      `test-dump.exe´ `test^^echo ^^^´
--------------------
<b style="color:blue">* 48) `test-dump.exe´ `test"^whoami´</b>
      `test-dump.exe´ `test"^whoami´
<b style="color:blue">* 48) `test-dump.CMD´ `test"^whoami´</b>
      `test-dump.exe´ `test"^whoami´
--------------------
<b style="color:blue">* 49) `test-dump.exe´ `test"^^echo ^^^´</b>
      `test-dump.exe´ `test"^^echo ^^^´
<b style="color:blue">* 49) `test-dump.CMD´ `test"^^echo ^^^´</b> -- <b style="color:red">*VULNERABLE*
      `test-dump.exe´ `test"echo ´
</b>
</pre></code>

The major injury is happened by pre-processing of the arguments with special meta-chars (so depends on quotes-count or position), but some tests show that Tcl seems to have here additionally insufficient escaping by some special characters (at least looks like vulnerable arguments-handling, also by execution of some tests without unpaired quotes (after escape).

Fixed in branch [/timeline?r=0-day-21b0629c81|0-day-21b0629c81].

Branch [fix-fb2fa9b3f6--percent-subst-regr] was merged with commit [ee7ec33deb]. Only the "%env%" part of ticket [ea3b6d6792] is reverted.
The requirement was ticket [fb2fa9b3f6].

Open work for a general multi-mode exec is pending.

Thanks to Sergey !

Harald

Sergey,
yes, I also think, we should only revert the special treatment of "%" by individual quoting.

The rest of the patch improves anyway already present quoting rules and fixes issues with them (double quoting).

Please just go on and merge it to 8.6.

Thank you and take care,
Harald

I meant only revert the special %-escape (so basically merge branch "fix-fb2fa9b3f6--percent-subst-regr"). Because the rest of [21b0629c81] is fully justified in my opinion, as well as more or less backwards compatible (unless one doesn't try to simulate special "raw" invocation by inject into old escape handling in order to get some special command line).

But sure, I can do that, once I'd get the fossil to hand.

Regarding the documentation, one'd then only need to meant that %-chars are not (yet) specially escaped, so by execution of comspec/batch/cmd windows would replace <code>%var%</code> with environment variables, and this way to become safe it could expect special handling by parameter escape, because may become "vulnerable" against double/triple quotes in whole command line.

Dear Sergey,
if you are the opinion, that this should be reverted, it would be great to do that soon.
I think, this would be a good thing, as the usability for me is higher, than the vulnerability protection.

Could you just act and do the changes?

I may assist and adapt the documentation.

Thank you for your constant effort, great !

Take care,
Harald

Well, conditionally true... 
Even main of many script langs are implemented not very compliant to "default" parameters parsing - see [the table in spoiler](https://github.com/reactos/reactos/pull/5186#issuecomment-1481559820).

But there is `CommandLineToArgvW` as well as `main` of msvcrt, ucrt, libstdc (mingw/gcc) and co, that behave in the same way.
Even reactos, wine and other "windows-like" systems and libraries implementing the command line parsing in that "standard" way.

Although the more or less correct handling of comspec (cmd/bat/etc) is hard job, and one can't really do that fully correctly - therefore there is a new branch [fix-fb2fa9b3f6--percent-subst-regr](/tcl/vdiff?from=7ed548b6b59bb496&to=fix-fb2fa9b3f6--percent-subst-regr), reverting parts of this fix, handling the percent char and so restore the backwards compatibility calling comspec with `%var%`.
As already said many times the percent escape was implemented only because otherwise it'd remain a bit vulnerable (double and triple quotes may change during exec), but since comspec remains unsafe by design, one could indeed restore that handling back (using aforementioned branch).

More or less with a future `-raw` option, one'd be able to implement own escape routines for any kind of executable, no matter how it does the command line parsing.

This fix implements correct escape for `CommandLineToArgvW` as well as `main` of msvcrt, ucrt, libstdc (mingw/gcc) and co, so quasi "standard" command line parser. And without merge of `fix-fb2fa9b3f6--percent-subst-regr` branch also for comspec as good as possible (but as already said, I'm for merge and fix it later using `-shell` option or in some special handler if `-raw` option gets implemented).

Ultimately, there isn't that much we can do because *Windows itself is not consistent.* When dealing with the Windows command line, parsing of that command line is done by the receiving program (usually by it's runtime bootstrap code) and that's inconsistent because there are multiple different runtimes in use out there. It's especially bad when dealing with the `CMD` builtins like `START`, but that's simply the most easily noticed. (There were, according to David Gravereaux, who worked on this, outright incompatibilities between the MSVC runtime and the Borland runtime that just could never be resolved; each had situations where it demanded quoting and the other required no quoting.)

Tcl has historically taken the view of trying to make things work well with the MSVC runtime (by far the most common) and for the rest... well, you can write stuff into a batch script (with as much safe control as you like) and run that. It's an impossible situation; direct use of the Windows command line to run programs with untrusted arguments is simply not secure. Note that `exec` and `open` are _never_ exposed directly in a safe interpreter; there's a reason for this and it's not something we're likely to change soon.

All IIRC. I've not made much use of this knowledge for over a decade (other than to always give `START` a leading blank argument because it's particularly awful).

Documentation of the current state added in core-8-6-branch and up:
[71dd06e857]

To control the quoting of exec is a purpose of a TIP which may come up soon.

Thanks, Sergey, for the help on the documentation,
Harald

Also, recent discussion on this topic may be found in ticket [fb2fa9b3f6].

Take care,
Harald

Thanks, great !

Proposed documentation for the introduced quoting in commit [7af4466e66] for review.

Review welcome !
Harald

So although now it is anyway better as it previously was, the story continues -
the handling round about percent character is a bit complex:
<code><pre style="padding-left:10pt">
% set ::env(X) "simple-X"; set ::env("X") "quoted-X"
% exec test-dump.cmd {%X%} {%"X"%} {"%X%"}
    `test-dump.exe´ `quoted-X´ `%"X"%´ `"quoted-X"´
</pre></code>
So the escaped sequence <code>"%"X"%"</code> causes that this time not variable <code>X</code> but variable <code>"X"</code> will be interpolated by the command processor.

<sub>Thanks to Eryk Sun (@eryksun) noticed this by the fix for python.</sub>

So there are three possible scenarios:<ol>
<li>either let it as is currently, so don't change something (the environment variable in quotes is very rare, but anyway it is a bit ugly as "good" solution);
</li><li>or try to find better escape handling (I assume possible only if it will be escaped differently for invocation of exe and cmd).
</li><li>if the "proper" escape of %-char will get state as really impossible or very complex (so can be defined as not a bug but "expected" feature), so let it be, but at least it belongs definitely into the documentation with some bold warning.
</li></ol>

So I'm by 2 at the moment, WiP.

closed within merge [99af12fd19] and the following, for >= 8.5

Grrr... amend in [ae46c72447] should fix it now (+ extends test-cases).

Further tests are welcome.

Never ending story: found new cases that are still uncovered by current fix:<br/>
- `%` char to be escaped (quoted) in any case (regardless pairing flag), otherwise `%username%` will be interpolated as username.<br/>
- escape of multiple backslashes before quote is different (as without following quote) in unpaired quote syntax (upaired flag set).<br/>
- etc.

WiP.

Although this fixed the issue, at the same time it is a bit incompatible if wanted "raw" (not escaped) arguments,<br/> for example by invocation of <code>cmd /c ...something raw, because script...</code>

Search for exec in own (as well as many open source) projects, shows me almost never the usage of "raw" arguments as expected case. In contrary, many invocation's of <code>cmd /c</code> expecting also that arguments are escaped properly.<br/>
Let alone real raw data were anyway impossible (because previously partially escaped also).

Therefore (and because this fixed a grave 0-day vulnerability), the default escape should take place as it is implemented in 0-day-21b0629c81.

But perhaps, just to provide the developer a possibility to invoke <code>cmd /c</code> with raw-unescaped scripts (e. g. something enclosed in 2x double-quoted block, like <code>cmd /c ""...raw-script...""</code> etc.), I suggest to extend "exec" with new option "-raw".
<code><pre style="padding-left: 10pt">
exec -raw cmd /c ""...raw-script-dev-want-escape-independent...""
</pre></code>
For *unix-platforms this can be simply ignored, but I assume it will be anyway used with <code>exec cmd</code> only, so already encapsulated into <code>if {$::tcl_platform(platform) eq "windows"} {exec -raw cmd ...}</code>.

Fixed in branch [/timeline?r=0-day-21b0629c81|0-day-21b0629c81] (for 8.5).<br/>
I'll merge it soon (>= 8.5), if no objections follow.

Updated with many other test-cases (with better readability as single-line, etc.).
<br/><i>Additionally I noticed, that previously I had created the tests using already partially fixed tcl-library (so regenerated now).</i>