os/exec: cmd.Env doesn't use provided PATH

[anuraaga]

What version of Go are you using (go version)?

$ go version
go version go1.18.4 darwin/arm64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOARCH="arm64"
GOHOSTARCH="arm64"
GOHOSTOS="darwin"
GOOS="darwin"

What did you do?

cmd := exec.Command("protoc", args...)
cmd.Env = []string{fmt.Sprintf("PATH=%s", protocDir)}
cmd.Run()

What did you expect to see?

protoc is resolved from the PATH passed to the command

What did you see instead?

protoc is resolved from the system PATH

The documentation does specifically say it uses LookPath

https://github.com/golang/go/blob/master/src/os/exec/exec.go#L249

But I interpreted that to still be when calling Run, not the constructor and believe that would be more intuitive for most users. Currently using a custom PATH and executable name is just not possible and an absolute path must be passed by the caller.

Changing the behavior would be incompatible though, so there may not really be anything we can do here but wanted to bring up the possibility of having the file resolved when run rather than before

[toothrot]

I believe this is working as intended. Please let me know if I am mistaken.

See https://go.dev/blog/path-security for details, and https://golang.org/wiki/Questions for getting more help.

[vatine]

I would expect protocto be looked up from the PATH set in the environment of the running Go process, and any path lookups done from the child protocto be looked up using the passed-along PATH environment variable,

To change the path used to look up the protocbinary, I would expect to have to call os.Setenv("PATH", ...), which may (or may not, I have not experimented) change the look-up.