env: a NUL byte in a `--file` entry reaches `std::env::set_var` unvalidated and aborts the process (exit 134)
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 24.1k
- Forks
- 2k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 365
Description
env --file FILE parses an .env/INI file and passes each key and value straight to std::env::set_var, which panics when either contains a NUL byte. A single NUL anywhere in the file therefore aborts env with a Rust panic instead of a diagnostic.
The argv path (env NAME=VALUE ...) is guarded — apply_specified_env_vars checks for an empty name before calling set_var, but the --file path has no guard at all.
Steps to reproduce
A NUL in the value:
$ printf 'KEY=a\x00b\n' > conf.env
$ env --file conf.env
thread 'main' panicked at library/std/src/env.rs:361:9:
failed to set environment variable `"KEY"` to `"a\0b"`: file name contained an unexpected NUL byte
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
$ echo $?
134
A NUL in the key does the same:
$ printf 'a\x00b=c\n' > k.env
$ env --file k.env # exit 134, identical panic
Root cause
std::env::set_var panics if either argument contains a NUL. Nothing between the parser and this call validates the bytes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/uu/env/src/env.rs around lines 331-338 and trace the --file path from parsed entries to std::env::set_var; compare it with apply_specified_env_vars, which guards the argv path. Reproduce the key and value NUL cases from the issue, then verify that both produce a diagnostic and non-panicking failure rather than exit 134.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100