uutils / uutils/coreutils

env: a NUL byte in a `--file` entry reaches `std::env::set_var` unvalidated and aborts the process (exit 134)

Open Beginner friendly
#14,490 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

U - env
Dominant language
Rust
Stars
24.1k
Forks
2k
Avg merge
1d 5h
Merged PRs (30d)
365

Description

env --file FILE parses an .env/INI file and passes each key and value straight to std::env::set_var, which panics when either contains a NUL byte. A single NUL anywhere in the file therefore aborts env with a Rust panic instead of a diagnostic.

The argv path (env NAME=VALUE ...) is guarded — apply_specified_env_vars checks for an empty name before calling set_var, but the --file path has no guard at all.

Steps to reproduce

A NUL in the value:

$ printf 'KEY=a\x00b\n' > conf.env
$ env --file conf.env
thread 'main' panicked at library/std/src/env.rs:361:9:
failed to set environment variable `"KEY"` to `"a\0b"`: file name contained an unexpected NUL byte
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
$ echo $?
134

A NUL in the key does the same:

$ printf 'a\x00b=c\n' > k.env
$ env --file k.env       # exit 134, identical panic

Root cause

https://github.com/uutils/coreutils/blob/2c0e1b981fdce56bb8cc729dffed702ff0410e8e/src/uu/env/src/env.rs#L331-L338

std::env::set_var panics if either argument contains a NUL. Nothing between the parser and this call validates the bytes.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/uu/env/src/env.rs around lines 331-338 and trace the --file path from parsed entries to std::env::set_var; compare it with apply_specified_env_vars, which guards the argv path. Reproduce the key and value NUL cases from the issue, then verify that both produce a diagnostic and non-panicking failure rather than exit 134.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
82/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.