Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

os/exec: cmd.Env doesn't use provided PATH #53996

Closed
anuraaga opened this issue Jul 22, 2022 · 2 comments
Closed

os/exec: cmd.Env doesn't use provided PATH #53996

anuraaga opened this issue Jul 22, 2022 · 2 comments

Comments

@anuraaga
Copy link
Contributor

What version of Go are you using (go version)?

$ go version
go version go1.18.4 darwin/arm64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
GOARCH="arm64"
GOHOSTARCH="arm64"
GOHOSTOS="darwin"
GOOS="darwin"

What did you do?

cmd := exec.Command("protoc", args...)
cmd.Env = []string{fmt.Sprintf("PATH=%s", protocDir)}
cmd.Run()

What did you expect to see?

protoc is resolved from the PATH passed to the command

What did you see instead?

protoc is resolved from the system PATH

The documentation does specifically say it uses LookPath

https://github.com/golang/go/blob/master/src/os/exec/exec.go#L249

But I interpreted that to still be when calling Run, not the constructor and believe that would be more intuitive for most users. Currently using a custom PATH and executable name is just not possible and an absolute path must be passed by the caller.

Changing the behavior would be incompatible though, so there may not really be anything we can do here but wanted to bring up the possibility of having the file resolved when run rather than before

@toothrot
Copy link
Contributor

I believe this is working as intended. Please let me know if I am mistaken.

See https://go.dev/blog/path-security for details, and https://golang.org/wiki/Questions for getting more help.

@toothrot toothrot changed the title affected/package: os/exec os/exec: cmd.Env doesn't use provided PATH Jul 22, 2022
@vatine
Copy link

vatine commented Jul 22, 2022

I would expect protocto be looked up from the PATH set in the environment of the running Go process, and any path lookups done from the child protocto be looked up using the passed-along PATH environment variable,

To change the path used to look up the protocbinary, I would expect to have to call os.Setenv("PATH", ...), which may (or may not, I have not experimented) change the look-up.

@golang golang locked and limited conversation to collaborators Jul 22, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

4 participants