Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

os.putEnv accepts invalid key #782

Open
juancarlospaco opened this issue Jul 14, 2021 · 2 comments
Open

os.putEnv accepts invalid key #782

juancarlospaco opened this issue Jul 14, 2021 · 2 comments

Comments

@juancarlospaco
Copy link
Collaborator

juancarlospaco commented Jul 14, 2021

os.putEnv accepts keys containing '='. This works, but should not:

import std/os
putEnv "a=b", "BUG"
>>> import os
>>> os.putenv("a=b", "BUG")

ValueError: illegal environment variable name

TODO

check whether other env APIs have a similar bug

  • os.putEnv
  • os.getEnv
  • os.existsEnv
  • os.delEnv

May or may not read/write/delete the wrong env vars, can be silently destructive to other env vars.

Best practices say that env var key names must be 1 non-empty ASCII string in the range [a-zA-Z0-9_] (DotEnv project docs).

@timotheecour
Copy link
Owner

this issue is only partially correct

the only thing to fix here is to use c_putenv as done in nim-lang#18530, after which putEnv "a=b", "BUG" will correctly raise

getEnv("foo=bar") should not raise (and doesn't raise currently, nor does it raise in python)

Best practices say that env var key names must be 1 non-empty ASCII string in the range [a-zA-Z0-9_] (DotEnv project docs).

std/os shouldn't impose restrictions, the underlying OS call to c_setenv will already fail for invalid input

@juancarlospaco
Copy link
Collaborator Author

this issue is only partially correct

Ok, feel free to edit it. 👍

@timotheecour timotheecour changed the title os.putEnv, os.getEnv accepts invalid os.putEnv accepts invalid key Jul 19, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants