Re: tests: dis/allow '.' in PATH?

[Bernhard Voelker <mail@bernhard-voelker.de>]

[-- Attachment #1: Type: text/plain, Size: 290 bytes --]

On 11/24/21 08:24, Kamil Dudka wrote:
> Note that having an "empty item" in PATH will have the same effect as
> having '.' in PATH, according to POSIX [1]:

Sure, the attached is an approach with shell tools, i.e., avoiding maybe
non-portable shell extensions.
WDYT?

Have a nice day,
Berny

[-- Attachment #2: 0001-test-framework-sh-remove-.-and-empty-entries-from-PA.patch --]
[-- Type: text/x-patch, Size: 2344 bytes --]

From a864d77c8b723fb3aede775c545320cfcedcc8bf Mon Sep 17 00:00:00 2001
From: Bernhard Voelker <mail@bernhard-voelker.de>
Date: Wed, 24 Nov 2021 23:59:00 +0100
Subject: [PATCH] test-framework-sh: remove '.' and empty entries from PATH

Running tests with '.' in the PATH may yield unspecified results,
and is deemed unsafe per se.  This includes empty entries as well
which are treated like a '.' entry as per POSIX.

* tests/init.sh (setup_): Add snippet to remove '.' and empty entries
from the PATH environment variable.
---
 ChangeLog     |  9 +++++++++
 tests/init.sh | 18 ++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 3e752b238..f858fee07 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2021-11-24  Bernhard Voelker  <mail@bernhard-voelker.de>
+
+	test-framework-sh: remove '.' and empty entries from PATH
+	Running tests with '.' in the PATH may yield unspecified results,
+	and is deemed unsafe per se.  This includes empty entries as well
+	which are treated like a '.' entry as per POSIX.
+	* tests/init.sh (setup_): Add snippet to remove '.' and empty entries
+	from the PATH environment variable.
+
 2021-11-24  Paul Eggert  <eggert@cs.ucla.edu>
 
 	regex: merge from glibc
diff --git a/tests/init.sh b/tests/init.sh
index 9ef834888..1f4d29e8b 100644
--- a/tests/init.sh
+++ b/tests/init.sh
@@ -426,6 +426,24 @@ setup_ ()
   for sig_ in 1 2 3 13 15; do
     eval "trap 'Exit $(expr $sig_ + 128)' $sig_"
   done
+
+  # Remove '.' from PATH, and also avoid "empty entries" which are treated as
+  # '.' as per POSIX, see PATH in:
+  # https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html
+  # Strategy:
+  # printf: wrap PATH with additional separator characters.
+  # tr: change all separators to newline.
+  # sed: remove dot entries; remove empty entries (note: trailing newline).
+  # tr: change newlines back to separators
+  # head: remove last trailing separator.
+  path_=`printf '%s' "${PATH_SEPARATOR}${PATH}${PATH_SEPARATOR}" \
+           | tr "${PATH_SEPARATOR}" "$gl_init_sh_nl_" \
+           | sed -e '/^\.$/d' -e '/^$/d'\
+           | tr "$gl_init_sh_nl_" "${PATH_SEPARATOR}" \
+           | head -c -1
+           `
+  PATH="$path_"
+  export PATH
 }
 
 # This is a stub function that is run upon trap (upon regular exit and
-- 
2.33.1