ffe97db4f9
The previous implementation double-quoted the _args variable by escaping each argument individually and then wrapping them all in single quotes, producing output like: _args=''-e' 'arg1' 'arg2'' This fix concatenates all arguments into a single string first, then escapes that string once, producing correct output like: _args='-e arg1 arg2' This prevents potential command injection issues when the output is sourced in shell scripts. Fixes #14327
37 lines
1.0 KiB
Bash
Executable File
37 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
source common.sh
|
|
|
|
clearStoreIfPossible
|
|
|
|
# Regression test for nix-store --print-env argument escaping
|
|
# This tests that arguments in _args are properly escaped as a single string
|
|
# rather than double-escaped which could lead to command injection
|
|
|
|
cat > "$TEST_ROOT/test-args.nix" <<'EOF'
|
|
derivation {
|
|
name = "test-print-env-args";
|
|
system = builtins.currentSystem;
|
|
builder = "/bin/sh";
|
|
args = [ "-c" "echo hello world" ];
|
|
}
|
|
EOF
|
|
|
|
drvPath=$(nix-instantiate "$TEST_ROOT/test-args.nix")
|
|
output=$(nix-store --print-env "$drvPath" | grep "^export _args")
|
|
|
|
# The output should be: export _args; _args='-c echo hello world'
|
|
# NOT: export _args; _args=''-c' 'echo hello world''
|
|
|
|
# Test that it can be safely evaluated
|
|
eval "$output"
|
|
expected="-c echo hello world"
|
|
# shellcheck disable=SC2154 # _args is set by the eval above
|
|
if [ "$_args" != "$expected" ]; then
|
|
echo "ERROR: _args not properly escaped!"
|
|
echo "Expected: $expected"
|
|
echo "Got: $_args"
|
|
echo "Raw output: $output"
|
|
exit 1
|
|
fi
|