Description
In test/test_common.sh line 36, the TFENV_ROOT variable is tested without quotes:
[ -n ${TFENV_ROOT} ] || ...Without quotes, [ -n ${TFENV_ROOT} ] will always evaluate to true even when TFENV_ROOT is empty, because an empty variable expands to nothing, leaving [ -n ] which tests whether the string -n is non-empty (it is).
With set -u enabled (which tfenv scripts use), an unset TFENV_ROOT would instead throw an "unbound variable" error before even reaching the test, but an empty-string TFENV_ROOT="" would silently pass this guard.
Expected
[ -n "${TFENV_ROOT}" ] || ...Impact
If TFENV_ROOT is set but empty, the guard check passes incorrectly, and tests run with an empty root path, which could cause confusing failures or even destructive operations on /.
Found via
Code review of all source files.
Description
In
test/test_common.shline 36, theTFENV_ROOTvariable is tested without quotes:Without quotes,
[ -n ${TFENV_ROOT} ]will always evaluate to true even whenTFENV_ROOTis empty, because an empty variable expands to nothing, leaving[ -n ]which tests whether the string-nis non-empty (it is).With
set -uenabled (which tfenv scripts use), an unsetTFENV_ROOTwould instead throw an "unbound variable" error before even reaching the test, but an empty-stringTFENV_ROOT=""would silently pass this guard.Expected
Impact
If
TFENV_ROOTis set but empty, the guard check passes incorrectly, and tests run with an empty root path, which could cause confusing failures or even destructive operations on/.Found via
Code review of all source files.