Pádraig Brady <[email protected]> writes:

> On 05/08/2026 05:03, Collin Funk wrote:
>> diff --git a/NEWS b/NEWS
>> index a85b0ada9..ac6184481 100644
>> --- a/NEWS
>> +++ b/NEWS
>> @@ -81,6 +81,10 @@ GNU coreutils NEWS                                    -*- 
>> outline -*-
>>     'df', 'du', 'ls', 'od', 'pr', and 'sort' now escape invalid arguments in 
>> error
>>     messages for options expecting an integer.
>>   +  'env' and 'printenv' now quote printed environment variables in
>> shell-escape
>> +  style.  This avoids printing arbitrary data to the terminal and allows the
>> +  output to be sourced by a POSIX shell.
>> +
>
> Yes, it makes sense to quote even when redirecting
> (unless QUOTE_STYLE=literal) as we were discussing at:
> https://github.com/coreutils/coreutils/issues/324
>
> One small worry is breaking usage like:
> foo=$(printenv foo) or popen("printenv foo").
> But that's not a practical concern as it's much more
> natural to access particular env vars directly.
> I did audit the following just in case:
> https://codesearch.debian.net/search?q=printenv.*\|.*(cut|sed)&literal=0
> but noticed no problematic usage.
> In fact quoting newlines in env var values would
> make the found usages more robust.

In the more general cases (ignoring many that are obvious tests), I have
found it is mostly stuff like this:

   $ printenv LC_ALL
   [...]

That one should obviously not be defined in a way that needs quoted.

I have also seen stuff like this:

   $ printenv | grep '^SSH_'
   [...]

That one should probably not ever have the need to be quoted, but I
guess it is possible. In any case, that one would be buggy if someone
defines an environment variable with "SSH_" following a newline.

> However this is worth moving from "Improvements" to
> "Changes in behavior" in NEWS, and I'd also mention that
> QUOTING_STYLE is honored. How about:
>
>   'env' and 'printenv' now quote printed environment variables honoring the
>   QUOTING_STYLE environment variable, defaulting to shell-escape style.
>   This avoids printing arbitrary data to the terminal and allows the
>   output to be sourced by a POSIX shell.

Makes sense. I pushed it with that change [1].

Collin

[1] 
https://github.com/coreutils/coreutils/commit/328322ca641a9eb2b500ab8f9e3cb68c41e1aa30

Reply via email to