Similary to the recommended parenthesis delimiter in echo command: Echo(
What is the recommended delimiter in call set command (used for double expansion) for avoid like this:
set.cmd
Code: Select all
Echo Injection
test.cmd
Code: Select all
@Echo Off
Set "text=Hi"
Set "var=%%text%%"
Call Set "exp=%var%"
Echo(%exp%
If set.cmd not exist test.cmd print:
Code: Select all
Hi
but if set.cmd exist test.cmd print:
Code: Select all
Injection
My question is because I really need do a double expansion, without delayedexpansion, and without call to a label, I need do it but avoiding possible calls to a possible: set.exe set.cmd or set.bat