buildkite / buildkite/agent

Hooks break with invalid environment variables

Open
#1,205 0 comments 0 reactions 0 assignees View on GitHub
hook
Dominant language
Go
Stars
1.1k
Forks
378
Avg merge
2d 6h
Merged PRs (30d)
74

Description

From a [forum post](https://forum.buildkite.community/t/buildkite-environment-hook-breaks-when-there-are-environment-variables-with-space-in-keys/573). If a hook script manages to set an invalid environment variable name, like:

```
package main

import (
"os"
"os/exec"
)

func main() {
// This works. Weird environment variables are created.
os.Setenv(" \n ", "hello")
os.Setenv("0AAA", "hello")
os.Setenv(" ", "/x/y/z")

c := exec.Command("/bin/bash", "-c", "export -p")
c.Stdout = os.Stdout
c.Stderr = os.Stderr
c.Run()
}
```

then bash will output something like this:

```
declare -x
declare -x

declare -x 0AAA
declare -x HOME="/root"
declare -x LANG="en_US.UTF-8"
declare -x LESSCLOSE="/usr/bin/lesspipe %s %s"
declare -x LESSOPEN="| /usr/bin/lesspipe %s"
declare -x LOGNAME="root"
...
```

which breaks the agent code which parses environments:

https://github.com/buildkite/agent/blob/bed05dda2d7bfb888d80c621af827ee2bce39144/env/export.go#L38-L133

and blows up the whole job in an obscure way.

We should probably make parsing a little smarter and able to skip bad lines for these cases, or blow up with a useful error.

Contributor guide

Open the contributing guide

Research direction

Start in env/export.go, especially the environment parsing code around lines 38-133, and reproduce the invalid-variable output shown in the issue. Trace how malformed export lines cause the job to fail, then define and implement either safe skipping or a useful parsing error, with tests covering the invalid names and preserving valid variables.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
ci-cd
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.