bug#19350: #19350 24.4; Incorrect quoting of %-signs for Windows command shell

[Noam Postavsky <npostavs@users.sourceforge.net>]

[-- Attachment #1: Type: text/plain, Size: 1354 bytes --]

On Mon, Aug 15, 2016 at 11:01 AM, Eli Zaretskii <eliz@gnu.org> wrote:
> From my POV, as long as Emacs itself doesn't produce such shell
> commands and/or environment variables for any of its features,
> avoiding this becomes user's responsibility, just like when working at
> the shell prompt.  Of course, if we can find a reliable solution to
> the problem that doesn't take away features, that'd be better,

So I have been thinking about this. As far as I can tell, the %CD:~,0%
hack is the only way to solve it. We can make it conditional on having
command extensions enabled, see attached.

The probing command I used for the default value for
w32-shell-command-extensions causes an error while dumping ("Searching
for program: No such file or directory,
C:/Users/npostavs/src/emacs/emacs-25/nt/cmdproxy.exe") so I've
commented it out for now. With this patch,

(let ((w32-shell-command-extensions t)
      (process-environment (cl-list* "ca^=with-caret"
                                     "ca=without-caret"
                                     process-environment)))
  (insert (shell-command-to-string
           (format "echo %s %s %s"
                   "%ca%"
                   (shell-quote-argument "%ca%")
                   "%%CD:~,0%ca%%CD:~,0%"))))

gives

without-caret "%ca%" %ca%

If this approach makes sense I can fix up the patch.

[-- Attachment #2: escaping-percent.diff --]
[-- Type: text/plain, Size: 2091 bytes --]

diff --git i/lisp/subr.el w/lisp/subr.el
index e9e19d3..1d7d0dd 100644
--- i/lisp/subr.el
+++ w/lisp/subr.el
@@ -2753,15 +2753,31 @@ shell-quote-argument
             "\\1\\1\\\\\""
             argument)))
 
-    (if (string-match "[%!\"]" argument)
-        (concat
-         "^\""
-         (replace-regexp-in-string
-          "\\([%!()\"<>&|^]\\)"
-          "^\\1"
-          argument)
-         "^\"")
-      (concat "\"" argument "\"")))
+    ;; cmd.exe performs %var% expansion before anything else, so there
+    ;; is no way escape '%'s (escaping with '^' *appears* to work, but
+    ;; that's only because variables with carets in the name are
+    ;; rare).  If "Command Extensions" are enabled, it's possible to
+    ;; work around this limitation by appending "%CD:~,0%" to each
+    ;; '%'; it expands to the empty string and stops the preceding '%'
+    ;; from being interpreted as the beginning of a variable name.
+    (cond
+     ((and w32-shell-command-extensions (string-match "%" argument))
+      (concat
+       "^\""
+       (replace-regexp-in-string
+        "\\([!()\"<>&|^]\\)"
+        "^\\1"
+        (replace-regexp-in-string "%" "%%CD:~,0%" argument t t))
+       "^\""))
+     ((string-match "[%!\"]" argument)
+      (concat
+       "^\""
+       (replace-regexp-in-string
+        "\\([%!()\"<>&|^]\\)"
+        "^\\1"
+        argument)
+       "^\""))
+     (t (concat "\"" argument "\""))))
 
    (t
     (if (equal argument "")
diff --git i/lisp/w32-vars.el w/lisp/w32-vars.el
index c9317e4..3e76a86 100644
--- i/lisp/w32-vars.el
+++ w/lisp/w32-vars.el
@@ -65,6 +65,13 @@ w32-list-proportional-fonts
    :type '(repeat string)
    :group 'w32))
 
+(unless (eq system-type 'cygwin)
+  (defcustom w32-shell-command-extensions nil ;; (equal (shell-command-to-string "echo %%CD:~,0%") "%\n")
+    "If non-nil, assume the shell supports \"Command Extensions\".
+This is used by `shell-quote-argument' to safely escape \"%\"."
+    :type 'boolean
+    :group 'w32))
+
 ;; Want "menu" custom type for this.
 (defcustom w32-fixed-font-alist
   '("Font menu"