2016-07-13 21:45 GMT+08:00 Marc Feeley <feeley@iro.umontreal.ca>:
Yes that’s one argument (the avoidance of system exploits through some data that is passed to the shell).
There’s also a portability argument. Shell escaping varies between platforms (Unix/Windows), and also from one shell to another.
Moreover, manual shell escaping has always been a nightmare (how many backslashes to add?) that it is best to avoid it completely by letting the implementation do it automatically. I wouldn’t like a system where the user has to worry about the possibility of arguments containing “$” and “\” and double/single quotes.
Ah those are fantastic arguments for it to be like it is now too. So for your use-case I would suggest:
(define (pkg-config-lib name) (call-with-input-process (list path: "pkg-config" arguments: (list "--libs" name)) read-line)) (pkg-config-lib "zlib") "-lz" (compile-file "test.scm" ld-options: (pkg-config-lib "libjpeg"))
Yup perfect. Thanks! Best regards