Rust has an API they provide which allows for calling batch files. This API has a flaw. The rust team acknowledged, and fixed the flaw.

If you provide an API it should be safe to use. If you don’t provide an API (C/C++) then its up to the programmer to implement it themselves. If that implementation has an issue in how it parses command line args, you would fault the developer of the parsing functionality for not escaping correctly. Thus the developers of the rust api which handles parsing command line arguments has a fault in its implementation.

ed. quick additional example. SQL injection can still be written today; if you just take arbitrary user input and execute it on a db, you open yourself up to exploitation. DB engines provide ways to parameterise queries to prevent this.

If the parameterisation routine allowed for sql injection exploits because it didn’t handle the inputs correctly, who would be at fault?

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-24576

The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an argument.

It goes onto discuss how this is more complex to do in windows, but the rust team chose to implement this, and as a consequence this implementation has an issue.

That forces the standard library to implement custom escaping for arguments passed to batch files. Unfortunately it was reported that our escaping logic was not thorough enough, and it was possible to pass malicious arguments that would result in arbitrary shell execution.