"Git Bash" Windows Terminal fragment profile uses unquoted commandline path #5100
Description
When the installer generates the git-bash Windows Terminal profile, it does so by constructing a commandline based on the install location:
For most installs, this will result in a commandline of C:/Program Files/git/bin/bash.exe -i -l
Unquoted commandline strings containing spaces are parsed incrementally, and may lead to unintended execution.
Quotes would tell Windows which part of the text represented the executable's path and which parts were command line arguments, if any. In the absence of quotes, Windows assumes that space characters are delimiters.
It rather involved being on the other side of this airtight hatchway: Unquoted service paths (2014)
first, it parses out C:\Program and looks for C:\Program.com, C:\Program.exe, C:\Program.Bat, etc. When it finds none of those, it assumes that the first space is not in fact a delimiter, treats the characters up to the next space character as part of the file path
ibid.