Update service_windows.go to avoid "unquoted search path" windows service issue

[ghost]

wrap exepath in quotes to avoid "unquoted search path" with windows services

[KatelynHaworth]

@kardianos are you able to review this PR? This issue is affecting the company I work for and if possible we would prefer to keep using your lib rather than a fork with this change.

[ghost]

I requested CVE-2022-29583 from MITRE

[masinger]

@trespassing-potato Could it be that you got fooled by your security scanner?

Because if you step into the m.CreateService(... call at line 256, you will see that the path is already being escaped by a call to syscall.EscapeArg() (see https://docs.microsoft.com/en-us/previous-versions/ms880421(v=msdn.10)?redirectedfrom=MSDN).

[twz123]

@trespassing-potato Do you maybe have a reproducer that triggers the vulnerability? What would a malicious input look like?

[ghost]

Hello! As I mentioned in #289 I tried to actually reproduce the issue discovered by our vulnerability scanner - but the added service in question (telegraf) does have a fully quoted path.

I apologize, I should have verified before doing anything :)