-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/46608/#review131235
-----------------------------------------------------------




3rdparty/libprocess/src/subprocess_windows.cpp (lines 305 - 352)
<https://reviews.apache.org/r/46608/#comment195141>

    (1) According to the "Security Remarks" section of https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx, it's recommended that we set the `lpApplicationName` parameter, rather than embedding the module name inside the `lpCommandLine` parameter since we need to make sure that the modulen name in `lpCommandLine` needs to be wrapped in quotes in case of spaces in the name. We don't seem to be doing this correctly.
    
    (2) `argumentsEscaped` is `new`ed, but not `delete`d, and according to the documentation for `CreateProcess`, it does not call `delete` on `lpCommandLine`. It looks like we're leaking?
    
    (3) Are we required to escape the quotes like we're doing here for `argumentsEscaped`...? I don't see anything like this in the documentation.
    
    What I would prefer to do here I think is to take a `argv` by value, then do:
    
    ```cpp
    string program = argv[0];
    argv.erase(argv.begin());
    string args = strings::join(" ", argv);
    
    ... = CreateProcess(
      program.data(),
      args.data(),
      ...);
    ```
    
    If we wanted to avoid using `lpApplicationName` for whatever reason, how about:
    
    ```cpp
    string program = "\"" + argv[0] + "\"";
    argv.erase(argv.begin());
    string args = strings::join(" ", argv);
    string cmd = strings::join(" ", program, args);
    
    ... = CreateProcess(
      NULL,
      cmd.data(),
      ...);
    ```


- Michael Park


On April 23, 2016, 11:41 p.m., Alex Clemmer wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/46608/
> -----------------------------------------------------------
> 
> (Updated April 23, 2016, 11:41 p.m.)
> 
> 
> Review request for mesos, Alex Naparu, Daniel Pravat, Artem Harutyunyan, Joris Van Remoortere, Michael Park, M Lawindi, and Yi Sun.
> 
> 
> Bugs: MESOS-3637
>     https://issues.apache.org/jira/browse/MESOS-3637
> 
> 
> Repository: mesos
> 
> 
> Description
> -------
> 
> Libprocess: Implemented `subprocess_windows.cpp`.
> 
> 
> Diffs
> -----
> 
>   3rdparty/libprocess/src/subprocess_windows.cpp PRE-CREATION 
> 
> Diff: https://reviews.apache.org/r/46608/diff/
> 
> 
> Testing
> -------
> 
> 
> Thanks,
> 
> Alex Clemmer
> 
>