I pushed this v2 patch now that the fix is in Gnulib. -- 8< --
* gnulib: Update to get commit 19e602707d (findprog-in: Use a default PATH like POSIX specifies., 2026-11-02). * tests/sort/sort-compress.sh: Add a test case. * NEWS: Mention the bug fix. Discovered by Anthropic's OSS Scanner, as bug ANT-2026-1R7RAVAG. --- NEWS | 7 +++++++ gnulib | 2 +- tests/sort/sort-compress.sh | 33 +++++++++++++++++++++++++++++++++ 3 files changed, 41 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index aee2afea0..45abd0077 100644 --- a/NEWS +++ b/NEWS @@ -129,6 +129,13 @@ GNU coreutils NEWS -*- outline -*- resolves to a path beginning with the symbolic link itself. [bug introduced in coreutils-9.0] + 'sort --compress-program=PROG' no longer treats an unset PATH environment + variable as equivalent to a PATH environment variable defined to an empty + string. On typical platforms, that would result in PROG being executed from + the current working directory, if it existed, when PATH was not defined in the + environment. + [bug introduced in coreutils-9.9] + 'stty' again rejects empty speed arguments. Previously such arguments were accepted as value 0. [bug introduced in coreutils-9.8] diff --git a/gnulib b/gnulib index 05812ed52..19e602707 160000 --- a/gnulib +++ b/gnulib @@ -1 +1 @@ -Subproject commit 05812ed525c0dca4151d6ecff9486263f5fdf00e +Subproject commit 19e602707d71fcad44b2f282ab88cb5b0be3eee4 diff --git a/tests/sort/sort-compress.sh b/tests/sort/sort-compress.sh index 12802ca02..b7cd9012f 100755 --- a/tests/sort/sort-compress.sh +++ b/tests/sort/sort-compress.sh @@ -51,6 +51,39 @@ compare exp out || fail=1 test -f ok || fail=1 rm -f ok +# Test that an unset PATH is not treated the same as an empty +# PATH, i.e., PATH=''. On GNU/Linux, an unset PATH searches +# the default path, but an empty PATH searches the current working +# directory. Since the behavior may differ on other platforms, we +# check it using 'env' first. In coreutils-9.9 to coreutils-9.12, +# an unset PATH was turned into an empty PATH. +sort=$(cmd_exe sort) || framework_failure_ +env -u PATH gzip </dev/null >/dev/null 2>&1 +if test $? -eq 0 && ! test -f ok; then + env -u PATH $sort -S 1k --compress-program=gzip in >out || fail=1 + compare exp out || fail=1 + test -f ok && fail=1 +fi +rm -f ok || framework_failure_ + +# Also test the behavior with PATH set to an empty string. +tr=$(cmd_exe tr) && +touch=$(cmd_exe touch) && +cat <<EOF >abs-gzip && +#!$SHELL +$tr 41 14 +$touch ok +EOF +chmod +x abs-gzip || framework_failure_ +env PATH= abs-gzip </dev/null >/dev/null 2>&1 +if test $? -eq 0 && test -f ok; then + rm -f ok || framework_failure_ + env PATH= $sort -S 1k --compress-program=abs-gzip in >out || fail=1 + compare exp out || fail=1 + test -f ok || fail=1 +fi +rm -f ok || framework_failure_ + # This is to make sure it works with no compression. PATH=.:$PATH sort -S 1k in > out || fail=1 compare exp out || fail=1 -- 2.56.0
