From 24f1def536c5344e0067a3119790b83ee6224058 Mon Sep 17 00:00:00 2001 From: miller Date: Mon, 8 May 2023 16:56:21 +0100 Subject: [PATCH 2/2] cmd/go: quote entries in list-valued variables for go env in plan9 When 'go env' without an argument prints environment variables as a script which can be executed by the shell, variables with a list value in Plan 9 (such as GOPATH) need to be printed with each element enclosed in single quotes in case it contains characters significant to the Plan 9 shell (such as ' ' or '='). For #58508 Change-Id: Ia30f51307cc6d07a7e3ada6bf9d60bf9951982ff Reviewed-on: https://go-review.googlesource.com/c/go/+/493535 Run-TryBot: Cherry Mui Reviewed-by: Cherry Mui Reviewed-by: Russ Cox TryBot-Result: Gopher Robot Auto-Submit: Dmitri Shuralyov CVE: CVE-2023-24531 Upstream-Status: Backport [05cc9e55876874462a4726ca0101c970838c80e5] Signed-off-by: Sakib Sajal --- src/cmd/go/internal/envcmd/env.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/cmd/go/internal/envcmd/env.go b/src/cmd/go/internal/envcmd/env.go index 5b52fad..d4fc399 100644 --- a/src/cmd/go/internal/envcmd/env.go +++ b/src/cmd/go/internal/envcmd/env.go @@ -431,8 +431,7 @@ func PrintEnv(w io.Writer, env []cfg.EnvVar) { if x > 0 { fmt.Fprintf(w, " ") } - // TODO(#59979): Does this need to be quoted like above? - fmt.Fprintf(w, "%s", s) + fmt.Fprintf(w, "'%s'", strings.ReplaceAll(s, "'", "''")) } fmt.Fprintf(w, ")\n") } -- 2.39.0