Bug #22199: win32: Kernel#system: `AA BB\` arrives as `AA BB"`

• Status: Closed
• Assignee: windows
• Target version: -
• ruby -v: ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +PRISM [x64-mingw-ucrt]
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[mame (Yusuke Endoh)]

PS C:\> ruby -ve "system('python3','-c','import sys; print(sys.argv[1])', 'AA BB\\')"
ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +PRISM [x64-mingw-ucrt]
AA BB"

AA BB\ was passed to Kernel#system, but python3.exe read it as AA BB".

What happens:

• Kernel#system creates and passes the command line string python3 ... "AA BB\" to CreateProcessW, and
• python3.exe (and anything else using the VC Runtime's command line parser) reads "AA BB\" as an (accidentally unterminated) AA BB".

It reproduces when an argument contains a space and ends with \.
When an argument contains a space, Kernel#system wraps it in double quotes.
If the argument also ends with \, that backslash is taken to escape the closing quote.

Kernel#system should escape the final backslash(es) when it wraps an argument that ends with one.
In the example above it should pass python3 ... "AA BB\\" to CreateProcessW.

Here is a PR for that: https://github.com/ruby/ruby/pull/17941

Note that cmd.exe and batch files do not interpret backslash escapes, so the backslash must NOT be escaped when calling those.
The PR escapes only when (1) the call does not go through cmd.exe, (2) the argument is wrapped in double quotes, and (3) the argument ends with \.

[mame (Yusuke Endoh)]

• Status changed from Assigned to Closed

Applied in changeset git|26a8633488bb84c4c005ce1d3f17bd2dbf22e358.

---

win32: escape a trailing backslash when quoting an argument

An argument ending in a backslash arrived corrupted: the backslash escaped the
closing quote that Kernel#system had added.

PS C:\> ruby -ve "system('python3','-c','import sys; print(sys.argv[1])', 'AA BB\\')"
ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +PRISM [x64-mingw-ucrt]
AA BB"

cmd.exe does not interpret backslash escapes, so the escaping is done only when
the call does not go through it.

[Bug #22199]