-
Notifications
You must be signed in to change notification settings - Fork 13.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Validate environment variable names in std::process
#126391
base: master
Are you sure you want to change the base?
Conversation
This comment has been minimized.
This comment has been minimized.
da26852
to
a733df6
Compare
This comment has been minimized.
This comment has been minimized.
a733df6
to
0cabc6f
Compare
6f7f6ac
to
cb33c5e
Compare
Thanks! @bors r+ rollup=iffy (because it touches lots of platforms) |
Validate environment variable names in `std::process` Make sure that they're not empty and do not contain `=` signs beyond the first character. This prevents environment variable injection, because previously, setting the `PATH=/opt:` variable to `foobar` would lead to the `PATH` variable being overridden. Fixes rust-lang#122335.
This comment has been minimized.
This comment has been minimized.
💔 Test failed - checks-actions |
|
Oh. on Windows |
Do you have a suggestion on how I could fix the test? |
I'm not sure how it can fixed using built-in shell tools as the point is they're not meant to be viewed. It could be done by spawning a rust application that reads the environment but that would probably need to be a ui tests. |
Oh, one idea I just had is that you can test for the specific variable. E.g. in cmd.exe |
☔ The latest upstream changes (presumably #124101) made this pull request unmergeable. Please resolve the merge conflicts. |
This (still? again?) has a merge conflict. @rustbot author |
fc85278
to
870e5bd
Compare
This comment has been minimized.
This comment has been minimized.
Make sure that they're not empty and do not contain `=` signs beyond the first character. This prevents environment variable injection, because previously, setting the `PATH=/opt:` variable to `foobar` would lead to the `PATH` variable being overridden. Fixes rust-lang#122335.
870e5bd
to
6e57e34
Compare
@rustbot ready |
@bors r+ |
Validate environment variable names in `std::process` Make sure that they're not empty and do not contain `=` signs beyond the first character. This prevents environment variable injection, because previously, setting the `PATH=/opt:` variable to `foobar` would lead to the `PATH` variable being overridden. Fixes rust-lang#122335. try-job: x86_64-msvc
The job Click to see the possible cause of the failure (guessed by this bot)
|
💔 Test failed - checks-actions |
Validate environment variable names in `std::process` Make sure that they're not empty and do not contain `=` signs beyond the first character. This prevents environment variable injection, because previously, setting the `PATH=/opt:` variable to `foobar` would lead to the `PATH` variable being overridden. Fixes rust-lang#122335. try-job: x86_64-msvc
💔 Test failed - checks-actions |
@bors r- |
I'm a bit at loss why the test fails on Android. We set the environment by replacing the |
@tbu- any updates on the failure? thanks |
Make sure that they're not empty and do not contain
=
signs beyond the first character. This prevents environment variable injection, because previously, setting thePATH=/opt:
variable tofoobar
would lead to thePATH
variable being overridden.Fixes #122335.
try-job: x86_64-msvc