[Full-disclosure] Re: Window's O/S

["Dave Korn" <davek_throwaway@xxxxxxxxxxx>]

pagvac wrote in 
news:b7a807650511240317n2eed488dr604e8e8f3cbd22d7@xxxxxxxxxxxxxx
> Confirmed on Windows XP SP2 (English Version).
>
> I still can't understand why that happens. I tried doing the same
> thing using different folder names of default Windows application
> executables (wordpad, iexplore, etc...) but it doesn't work.
>

  Because iexplore.exe implements "View source" by storing the source in a 
temp file and then launching the command line "notepad <temp_file_name>", 
and in the case above, the current directory of the iexplore.exe process 
must be the desktop, and since 'doze always searches '.' as the first 
element of %PATH%, it finds the folder, and then launches it.  Note that you 
can achieve the same effect by saying "start <foldernameincurrentdir>" at a 
DOS prompt; see MSDN for ShellExecuteEx if you want the real innards of the 
problem.

  This is also very much like the issue with having a file called 
"program.exe" in the root of your C: drive; the next time someone tries to 
launch a program through a path like "C:\program files\foo\bar.exe", and 
they don't adequately quote the path, 'doze interprets it as meaning "Run 
C:\program.exe with the single command-line argumetn 'file\foo\bar.exe'"

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today.... 



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/