On 05/08/2026 05:03, Collin Funk wrote:
diff --git a/NEWS b/NEWS
index a85b0ada9..ac6184481 100644
--- a/NEWS
+++ b/NEWS
@@ -81,6 +81,10 @@ GNU coreutils NEWS -*-
outline -*-
'df', 'du', 'ls', 'od', 'pr', and 'sort' now escape invalid arguments in
error
messages for options expecting an integer.
+ 'env' and 'printenv' now quote printed environment variables in shell-escape
+ style. This avoids printing arbitrary data to the terminal and allows the
+ output to be sourced by a POSIX shell.
+
Yes, it makes sense to quote even when redirecting
(unless QUOTE_STYLE=literal) as we were discussing at:
https://github.com/coreutils/coreutils/issues/324
One small worry is breaking usage like:
foo=$(printenv foo) or popen("printenv foo").
But that's not a practical concern as it's much more
natural to access particular env vars directly.
I did audit the following just in case:
https://codesearch.debian.net/search?q=printenv.*\|.*(cut|sed)&literal=0
but noticed no problematic usage.
In fact quoting newlines in env var values would
make the found usages more robust.
However this is worth moving from "Improvements" to
"Changes in behavior" in NEWS, and I'd also mention that
QUOTING_STYLE is honored. How about:
'env' and 'printenv' now quote printed environment variables honoring the
QUOTING_STYLE environment variable, defaulting to shell-escape style.
This avoids printing arbitrary data to the terminal and allows the
output to be sourced by a POSIX shell.
thanks!
Padraig
