Pádraig Brady <[email protected]> writes:

> There was a report that the change to quote output from env by default,
> even if output is not a tty, caused some breakage:
>
> https://github.com/coreutils/coreutils/issues/355
>
> Note the usage described there is non-robust,
> and seems rare (no cases on debian codesearch)
> and can be avoided by adding QUOTING_STYLE=literal etc.
>
> Also When reviewing more cases on debian codesearch
> there were many cases that were made more robust
> with the current behavior of quoting.
>
> So I'm 50:50 on reverting with the attached.
>
> I'll leave it distill for a while longer at least.

I am conflicted as well. It still feels like an improvement, but it has
caused a few unforeseen breakages, which is concerning.

Note that I also see this affecting kwallet-pam [1]. It looks like they
were writing 'env' to a Unix socket and then kwalletd reads from it
using "fgets (buf, 1000, fp)" before using putenv [2]. That could enter
bogus variables into the environment if any of their values have
newlines. A large part of our rationale was trying to protect against
that.

However, since they depended on 'env' not being quoted, it breaks, which
is not our goal, of course.

Collin

[1] https://bugs.kde.org/525805
[2] 
https://github.com/KDE/kde-runtime/blob/d765545023776ec49ae9bd183176014143fe15d3/kwalletd/main.cpp#L70-L98

Reply via email to