Pádraig Brady <[email protected]> writes: > On 05/08/2026 05:03, Collin Funk wrote: >> diff --git a/NEWS b/NEWS >> index a85b0ada9..ac6184481 100644 >> --- a/NEWS >> +++ b/NEWS >> @@ -81,6 +81,10 @@ GNU coreutils NEWS -*- >> outline -*- >> 'df', 'du', 'ls', 'od', 'pr', and 'sort' now escape invalid arguments in >> error >> messages for options expecting an integer. >> + 'env' and 'printenv' now quote printed environment variables in >> shell-escape >> + style. This avoids printing arbitrary data to the terminal and allows the >> + output to be sourced by a POSIX shell. >> + > > Yes, it makes sense to quote even when redirecting > (unless QUOTE_STYLE=literal) as we were discussing at: > https://github.com/coreutils/coreutils/issues/324 > > One small worry is breaking usage like: > foo=$(printenv foo) or popen("printenv foo"). > But that's not a practical concern as it's much more > natural to access particular env vars directly. > I did audit the following just in case: > https://codesearch.debian.net/search?q=printenv.*\|.*(cut|sed)&literal=0 > but noticed no problematic usage. > In fact quoting newlines in env var values would > make the found usages more robust.
In the more general cases (ignoring many that are obvious tests), I have found it is mostly stuff like this: $ printenv LC_ALL [...] That one should obviously not be defined in a way that needs quoted. I have also seen stuff like this: $ printenv | grep '^SSH_' [...] That one should probably not ever have the need to be quoted, but I guess it is possible. In any case, that one would be buggy if someone defines an environment variable with "SSH_" following a newline. > However this is worth moving from "Improvements" to > "Changes in behavior" in NEWS, and I'd also mention that > QUOTING_STYLE is honored. How about: > > 'env' and 'printenv' now quote printed environment variables honoring the > QUOTING_STYLE environment variable, defaulting to shell-escape style. > This avoids printing arbitrary data to the terminal and allows the > output to be sourced by a POSIX shell. Makes sense. I pushed it with that change [1]. Collin [1] https://github.com/coreutils/coreutils/commit/328322ca641a9eb2b500ab8f9e3cb68c41e1aa30
