Source file src/os/exec/exec.go

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Package exec runs external commands. It wraps os.StartProcess to make it
     6  // easier to remap stdin and stdout, connect I/O with pipes, and do other
     7  // adjustments.
     8  //
     9  // Unlike the "system" library call from C and other languages, the
    10  // os/exec package intentionally does not invoke the system shell and
    11  // does not expand any glob patterns or handle other expansions,
    12  // pipelines, or redirections typically done by shells. The package
    13  // behaves more like C's "exec" family of functions. To expand glob
    14  // patterns, either call the shell directly, taking care to escape any
    15  // dangerous input, or use the [path/filepath] package's Glob function.
    16  // To expand environment variables, use package os's ExpandEnv.
    17  //
    18  // Note that the examples in this package assume a Unix system.
    19  // They may not run on Windows, and they do not run in the Go Playground
    20  // used by golang.org and godoc.org.
    21  //
    22  // # Executables in the current directory
    23  //
    24  // The functions [Command] and [LookPath] look for a program
    25  // in the directories listed in the current path, following the
    26  // conventions of the host operating system.
    27  // Operating systems have for decades included the current
    28  // directory in this search, sometimes implicitly and sometimes
    29  // configured explicitly that way by default.
    30  // Modern practice is that including the current directory
    31  // is usually unexpected and often leads to security problems.
    32  //
    33  // To avoid those security problems, as of Go 1.19, this package will not resolve a program
    34  // using an implicit or explicit path entry relative to the current directory.
    35  // That is, if you run [LookPath]("go"), it will not successfully return
    36  // ./go on Unix nor .\go.exe on Windows, no matter how the path is configured.
    37  // Instead, if the usual path algorithms would result in that answer,
    38  // these functions return an error err satisfying [errors.Is](err, [ErrDot]).
    39  //
    40  // For example, consider these two program snippets:
    41  //
    42  //	path, err := exec.LookPath("prog")
    43  //	if err != nil {
    44  //		log.Fatal(err)
    45  //	}
    46  //	use(path)
    47  //
    48  // and
    49  //
    50  //	cmd := exec.Command("prog")
    51  //	if err := cmd.Run(); err != nil {
    52  //		log.Fatal(err)
    53  //	}
    54  //
    55  // These will not find and run ./prog or .\prog.exe,
    56  // no matter how the current path is configured.
    57  //
    58  // Code that always wants to run a program from the current directory
    59  // can be rewritten to say "./prog" instead of "prog".
    60  //
    61  // Code that insists on including results from relative path entries
    62  // can instead override the error using an errors.Is check:
    63  //
    64  //	path, err := exec.LookPath("prog")
    65  //	if errors.Is(err, exec.ErrDot) {
    66  //		err = nil
    67  //	}
    68  //	if err != nil {
    69  //		log.Fatal(err)
    70  //	}
    71  //	use(path)
    72  //
    73  // and
    74  //
    75  //	cmd := exec.Command("prog")
    76  //	if errors.Is(cmd.Err, exec.ErrDot) {
    77  //		cmd.Err = nil
    78  //	}
    79  //	if err := cmd.Run(); err != nil {
    80  //		log.Fatal(err)
    81  //	}
    82  //
    83  // Setting the environment variable GODEBUG=execerrdot=0
    84  // disables generation of ErrDot entirely, temporarily restoring the pre-Go 1.19
    85  // behavior for programs that are unable to apply more targeted fixes.
    86  // A future version of Go may remove support for this variable.
    87  //
    88  // Before adding such overrides, make sure you understand the
    89  // security implications of doing so.
    90  // See https://go.dev/blog/path-security for more information.
    91  package exec
    92  
    93  import (
    94  	"bytes"
    95  	"context"
    96  	"errors"
    97  	"internal/godebug"
    98  	"internal/syscall/execenv"
    99  	"io"
   100  	"os"
   101  	"path/filepath"
   102  	"runtime"
   103  	"strconv"
   104  	"strings"
   105  	"syscall"
   106  	"time"
   107  )
   108  
   109  // Error is returned by [LookPath] when it fails to classify a file as an
   110  // executable.
   111  type Error struct {
   112  	// Name is the file name for which the error occurred.
   113  	Name string
   114  	// Err is the underlying error.
   115  	Err error
   116  }
   117  
   118  func (e *Error) Error() string {
   119  	return "exec: " + strconv.Quote(e.Name) + ": " + e.Err.Error()
   120  }
   121  
   122  func (e *Error) Unwrap() error { return e.Err }
   123  
   124  // ErrWaitDelay is returned by [Cmd.Wait] if the process exits with a
   125  // successful status code but its output pipes are not closed before the
   126  // command's WaitDelay expires.
   127  var ErrWaitDelay = errors.New("exec: WaitDelay expired before I/O complete")
   128  
   129  // wrappedError wraps an error without relying on fmt.Errorf.
   130  type wrappedError struct {
   131  	prefix string
   132  	err    error
   133  }
   134  
   135  func (w wrappedError) Error() string {
   136  	return w.prefix + ": " + w.err.Error()
   137  }
   138  
   139  func (w wrappedError) Unwrap() error {
   140  	return w.err
   141  }
   142  
   143  // Cmd represents an external command being prepared or run.
   144  //
   145  // A Cmd cannot be reused after calling its [Cmd.Run], [Cmd.Output] or [Cmd.CombinedOutput]
   146  // methods.
   147  type Cmd struct {
   148  	// Path is the path of the command to run.
   149  	//
   150  	// This is the only field that must be set to a non-zero
   151  	// value. If Path is relative, it is evaluated relative
   152  	// to Dir.
   153  	Path string
   154  
   155  	// Args holds command line arguments, including the command as Args[0].
   156  	// If the Args field is empty or nil, Run uses {Path}.
   157  	//
   158  	// In typical use, both Path and Args are set by calling Command.
   159  	Args []string
   160  
   161  	// Env specifies the environment of the process.
   162  	// Each entry is of the form "key=value".
   163  	// If Env is nil, the new process uses the current process's
   164  	// environment.
   165  	// If Env contains duplicate environment keys, only the last
   166  	// value in the slice for each duplicate key is used.
   167  	// As a special case on Windows, SYSTEMROOT is always added if
   168  	// missing and not explicitly set to the empty string.
   169  	Env []string
   170  
   171  	// Dir specifies the working directory of the command.
   172  	// If Dir is the empty string, Run runs the command in the
   173  	// calling process's current directory.
   174  	Dir string
   175  
   176  	// Stdin specifies the process's standard input.
   177  	//
   178  	// If Stdin is nil, the process reads from the null device (os.DevNull).
   179  	//
   180  	// If Stdin is an *os.File, the process's standard input is connected
   181  	// directly to that file.
   182  	//
   183  	// Otherwise, during the execution of the command a separate
   184  	// goroutine reads from Stdin and delivers that data to the command
   185  	// over a pipe. In this case, Wait does not complete until the goroutine
   186  	// stops copying, either because it has reached the end of Stdin
   187  	// (EOF or a read error), or because writing to the pipe returned an error,
   188  	// or because a nonzero WaitDelay was set and expired.
   189  	Stdin io.Reader
   190  
   191  	// Stdout and Stderr specify the process's standard output and error.
   192  	//
   193  	// If either is nil, Run connects the corresponding file descriptor
   194  	// to the null device (os.DevNull).
   195  	//
   196  	// If either is an *os.File, the corresponding output from the process
   197  	// is connected directly to that file.
   198  	//
   199  	// Otherwise, during the execution of the command a separate goroutine
   200  	// reads from the process over a pipe and delivers that data to the
   201  	// corresponding Writer. In this case, Wait does not complete until the
   202  	// goroutine reaches EOF or encounters an error or a nonzero WaitDelay
   203  	// expires.
   204  	//
   205  	// If Stdout and Stderr are the same writer, and have a type that can
   206  	// be compared with ==, at most one goroutine at a time will call Write.
   207  	Stdout io.Writer
   208  	Stderr io.Writer
   209  
   210  	// ExtraFiles specifies additional open files to be inherited by the
   211  	// new process. It does not include standard input, standard output, or
   212  	// standard error. If non-nil, entry i becomes file descriptor 3+i.
   213  	//
   214  	// ExtraFiles is not supported on Windows.
   215  	ExtraFiles []*os.File
   216  
   217  	// SysProcAttr holds optional, operating system-specific attributes.
   218  	// Run passes it to os.StartProcess as the os.ProcAttr's Sys field.
   219  	SysProcAttr *syscall.SysProcAttr
   220  
   221  	// Process is the underlying process, once started.
   222  	Process *os.Process
   223  
   224  	// ProcessState contains information about an exited process.
   225  	// If the process was started successfully, Wait or Run will
   226  	// populate its ProcessState when the command completes.
   227  	ProcessState *os.ProcessState
   228  
   229  	// ctx is the context passed to CommandContext, if any.
   230  	ctx context.Context
   231  
   232  	Err error // LookPath error, if any.
   233  
   234  	// If Cancel is non-nil, the command must have been created with
   235  	// CommandContext and Cancel will be called when the command's
   236  	// Context is done. By default, CommandContext sets Cancel to
   237  	// call the Kill method on the command's Process.
   238  	//
   239  	// Typically a custom Cancel will send a signal to the command's
   240  	// Process, but it may instead take other actions to initiate cancellation,
   241  	// such as closing a stdin or stdout pipe or sending a shutdown request on a
   242  	// network socket.
   243  	//
   244  	// If the command exits with a success status after Cancel is
   245  	// called, and Cancel does not return an error equivalent to
   246  	// os.ErrProcessDone, then Wait and similar methods will return a non-nil
   247  	// error: either an error wrapping the one returned by Cancel,
   248  	// or the error from the Context.
   249  	// (If the command exits with a non-success status, or Cancel
   250  	// returns an error that wraps os.ErrProcessDone, Wait and similar methods
   251  	// continue to return the command's usual exit status.)
   252  	//
   253  	// If Cancel is set to nil, nothing will happen immediately when the command's
   254  	// Context is done, but a nonzero WaitDelay will still take effect. That may
   255  	// be useful, for example, to work around deadlocks in commands that do not
   256  	// support shutdown signals but are expected to always finish quickly.
   257  	//
   258  	// Cancel will not be called if Start returns a non-nil error.
   259  	Cancel func() error
   260  
   261  	// If WaitDelay is non-zero, it bounds the time spent waiting on two sources
   262  	// of unexpected delay in Wait: a child process that fails to exit after the
   263  	// associated Context is canceled, and a child process that exits but leaves
   264  	// its I/O pipes unclosed.
   265  	//
   266  	// The WaitDelay timer starts when either the associated Context is done or a
   267  	// call to Wait observes that the child process has exited, whichever occurs
   268  	// first. When the delay has elapsed, the command shuts down the child process
   269  	// and/or its I/O pipes.
   270  	//
   271  	// If the child process has failed to exit — perhaps because it ignored or
   272  	// failed to receive a shutdown signal from a Cancel function, or because no
   273  	// Cancel function was set — then it will be terminated using os.Process.Kill.
   274  	//
   275  	// Then, if the I/O pipes communicating with the child process are still open,
   276  	// those pipes are closed in order to unblock any goroutines currently blocked
   277  	// on Read or Write calls.
   278  	//
   279  	// If pipes are closed due to WaitDelay, no Cancel call has occurred,
   280  	// and the command has otherwise exited with a successful status, Wait and
   281  	// similar methods will return ErrWaitDelay instead of nil.
   282  	//
   283  	// If WaitDelay is zero (the default), I/O pipes will be read until EOF,
   284  	// which might not occur until orphaned subprocesses of the command have
   285  	// also closed their descriptors for the pipes.
   286  	WaitDelay time.Duration
   287  
   288  	// childIOFiles holds closers for any of the child process's
   289  	// stdin, stdout, and/or stderr files that were opened by the Cmd itself
   290  	// (not supplied by the caller). These should be closed as soon as they
   291  	// are inherited by the child process.
   292  	childIOFiles []io.Closer
   293  
   294  	// parentIOPipes holds closers for the parent's end of any pipes
   295  	// connected to the child's stdin, stdout, and/or stderr streams
   296  	// that were opened by the Cmd itself (not supplied by the caller).
   297  	// These should be closed after Wait sees the command and copying
   298  	// goroutines exit, or after WaitDelay has expired.
   299  	parentIOPipes []io.Closer
   300  
   301  	// goroutine holds a set of closures to execute to copy data
   302  	// to and/or from the command's I/O pipes.
   303  	goroutine []func() error
   304  
   305  	// If goroutineErr is non-nil, it receives the first error from a copying
   306  	// goroutine once all such goroutines have completed.
   307  	// goroutineErr is set to nil once its error has been received.
   308  	goroutineErr <-chan error
   309  
   310  	// If ctxResult is non-nil, it receives the result of watchCtx exactly once.
   311  	ctxResult <-chan ctxResult
   312  
   313  	// The stack saved when the Command was created, if GODEBUG contains
   314  	// execwait=2. Used for debugging leaks.
   315  	createdByStack []byte
   316  
   317  	// For a security release long ago, we created x/sys/execabs,
   318  	// which manipulated the unexported lookPathErr error field
   319  	// in this struct. For Go 1.19 we exported the field as Err error,
   320  	// above, but we have to keep lookPathErr around for use by
   321  	// old programs building against new toolchains.
   322  	// The String and Start methods look for an error in lookPathErr
   323  	// in preference to Err, to preserve the errors that execabs sets.
   324  	//
   325  	// In general we don't guarantee misuse of reflect like this,
   326  	// but the misuse of reflect was by us, the best of various bad
   327  	// options to fix the security problem, and people depend on
   328  	// those old copies of execabs continuing to work.
   329  	// The result is that we have to leave this variable around for the
   330  	// rest of time, a compatibility scar.
   331  	//
   332  	// See https://go.dev/blog/path-security
   333  	// and https://go.dev/issue/43724 for more context.
   334  	lookPathErr error
   335  
   336  	// cachedLookExtensions caches the result of calling lookExtensions.
   337  	// It is set when Command is called with an absolute path, letting it do
   338  	// the work of resolving the extension, so Start doesn't need to do it again.
   339  	// This is only used on Windows.
   340  	cachedLookExtensions struct{ in, out string }
   341  }
   342  
   343  // A ctxResult reports the result of watching the Context associated with a
   344  // running command (and sending corresponding signals if needed).
   345  type ctxResult struct {
   346  	err error
   347  
   348  	// If timer is non-nil, it expires after WaitDelay has elapsed after
   349  	// the Context is done.
   350  	//
   351  	// (If timer is nil, that means that the Context was not done before the
   352  	// command completed, or no WaitDelay was set, or the WaitDelay already
   353  	// expired and its effect was already applied.)
   354  	timer *time.Timer
   355  }
   356  
   357  var execwait = godebug.New("#execwait")
   358  var execerrdot = godebug.New("execerrdot")
   359  
   360  // Command returns the [Cmd] struct to execute the named program with
   361  // the given arguments.
   362  //
   363  // It sets only the Path and Args in the returned structure.
   364  //
   365  // If name contains no path separators, Command uses [LookPath] to
   366  // resolve name to a complete path if possible. Otherwise it uses name
   367  // directly as Path.
   368  //
   369  // The returned Cmd's Args field is constructed from the command name
   370  // followed by the elements of arg, so arg should not include the
   371  // command name itself. For example, Command("echo", "hello").
   372  // Args[0] is always name, not the possibly resolved Path.
   373  //
   374  // On Windows, processes receive the whole command line as a single string
   375  // and do their own parsing. Command combines and quotes Args into a command
   376  // line string with an algorithm compatible with applications using
   377  // CommandLineToArgvW (which is the most common way). Notable exceptions are
   378  // msiexec.exe and cmd.exe (and thus, all batch files), which have a different
   379  // unquoting algorithm. In these or other similar cases, you can do the
   380  // quoting yourself and provide the full command line in SysProcAttr.CmdLine,
   381  // leaving Args empty.
   382  func Command(name string, arg ...string) *Cmd {
   383  	cmd := &Cmd{
   384  		Path: name,
   385  		Args: append([]string{name}, arg...),
   386  	}
   387  
   388  	if v := execwait.Value(); v != "" {
   389  		if v == "2" {
   390  			// Obtain the caller stack. (This is equivalent to runtime/debug.Stack,
   391  			// copied to avoid importing the whole package.)
   392  			stack := make([]byte, 1024)
   393  			for {
   394  				n := runtime.Stack(stack, false)
   395  				if n < len(stack) {
   396  					stack = stack[:n]
   397  					break
   398  				}
   399  				stack = make([]byte, 2*len(stack))
   400  			}
   401  
   402  			if i := bytes.Index(stack, []byte("\nos/exec.Command(")); i >= 0 {
   403  				stack = stack[i+1:]
   404  			}
   405  			cmd.createdByStack = stack
   406  		}
   407  
   408  		runtime.SetFinalizer(cmd, func(c *Cmd) {
   409  			if c.Process != nil && c.ProcessState == nil {
   410  				debugHint := ""
   411  				if c.createdByStack == nil {
   412  					debugHint = " (set GODEBUG=execwait=2 to capture stacks for debugging)"
   413  				} else {
   414  					os.Stderr.WriteString("GODEBUG=execwait=2 detected a leaked exec.Cmd created by:\n")
   415  					os.Stderr.Write(c.createdByStack)
   416  					os.Stderr.WriteString("\n")
   417  					debugHint = ""
   418  				}
   419  				panic("exec: Cmd started a Process but leaked without a call to Wait" + debugHint)
   420  			}
   421  		})
   422  	}
   423  
   424  	if filepath.Base(name) == name {
   425  		lp, err := LookPath(name)
   426  		if lp != "" {
   427  			// Update cmd.Path even if err is non-nil.
   428  			// If err is ErrDot (especially on Windows), lp may include a resolved
   429  			// extension (like .exe or .bat) that should be preserved.
   430  			cmd.Path = lp
   431  		}
   432  		if err != nil {
   433  			cmd.Err = err
   434  		}
   435  	} else if runtime.GOOS == "windows" && filepath.IsAbs(name) {
   436  		// We may need to add a filename extension from PATHEXT
   437  		// or verify an extension that is already present.
   438  		// Since the path is absolute, its extension should be unambiguous
   439  		// and independent of cmd.Dir, and we can go ahead and cache the lookup now.
   440  		//
   441  		// Note that we don't cache anything here for relative paths, because
   442  		// cmd.Dir may be set after we return from this function and that may
   443  		// cause the command to resolve to a different extension.
   444  		if lp, err := lookExtensions(name, ""); err == nil {
   445  			cmd.cachedLookExtensions.in, cmd.cachedLookExtensions.out = name, lp
   446  		} else {
   447  			cmd.Err = err
   448  		}
   449  	}
   450  	return cmd
   451  }
   452  
   453  // CommandContext is like [Command] but includes a context.
   454  //
   455  // The provided context is used to interrupt the process
   456  // (by calling cmd.Cancel or [os.Process.Kill])
   457  // if the context becomes done before the command completes on its own.
   458  //
   459  // CommandContext sets the command's Cancel function to invoke the Kill method
   460  // on its Process, and leaves its WaitDelay unset. The caller may change the
   461  // cancellation behavior by modifying those fields before starting the command.
   462  func CommandContext(ctx context.Context, name string, arg ...string) *Cmd {
   463  	if ctx == nil {
   464  		panic("nil Context")
   465  	}
   466  	cmd := Command(name, arg...)
   467  	cmd.ctx = ctx
   468  	cmd.Cancel = func() error {
   469  		return cmd.Process.Kill()
   470  	}
   471  	return cmd
   472  }
   473  
   474  // String returns a human-readable description of c.
   475  // It is intended only for debugging.
   476  // In particular, it is not suitable for use as input to a shell.
   477  // The output of String may vary across Go releases.
   478  func (c *Cmd) String() string {
   479  	if c.Err != nil || c.lookPathErr != nil {
   480  		// failed to resolve path; report the original requested path (plus args)
   481  		return strings.Join(c.Args, " ")
   482  	}
   483  	// report the exact executable path (plus args)
   484  	b := new(strings.Builder)
   485  	b.WriteString(c.Path)
   486  	for _, a := range c.Args[1:] {
   487  		b.WriteByte(' ')
   488  		b.WriteString(a)
   489  	}
   490  	return b.String()
   491  }
   492  
   493  // interfaceEqual protects against panics from doing equality tests on
   494  // two interfaces with non-comparable underlying types.
   495  func interfaceEqual(a, b any) bool {
   496  	defer func() {
   497  		recover()
   498  	}()
   499  	return a == b
   500  }
   501  
   502  func (c *Cmd) argv() []string {
   503  	if len(c.Args) > 0 {
   504  		return c.Args
   505  	}
   506  	return []string{c.Path}
   507  }
   508  
   509  func (c *Cmd) childStdin() (*os.File, error) {
   510  	if c.Stdin == nil {
   511  		f, err := os.Open(os.DevNull)
   512  		if err != nil {
   513  			return nil, err
   514  		}
   515  		c.childIOFiles = append(c.childIOFiles, f)
   516  		return f, nil
   517  	}
   518  
   519  	if f, ok := c.Stdin.(*os.File); ok {
   520  		return f, nil
   521  	}
   522  
   523  	pr, pw, err := os.Pipe()
   524  	if err != nil {
   525  		return nil, err
   526  	}
   527  
   528  	c.childIOFiles = append(c.childIOFiles, pr)
   529  	c.parentIOPipes = append(c.parentIOPipes, pw)
   530  	c.goroutine = append(c.goroutine, func() error {
   531  		_, err := io.Copy(pw, c.Stdin)
   532  		if skipStdinCopyError(err) {
   533  			err = nil
   534  		}
   535  		if err1 := pw.Close(); err == nil {
   536  			err = err1
   537  		}
   538  		return err
   539  	})
   540  	return pr, nil
   541  }
   542  
   543  func (c *Cmd) childStdout() (*os.File, error) {
   544  	return c.writerDescriptor(c.Stdout)
   545  }
   546  
   547  func (c *Cmd) childStderr(childStdout *os.File) (*os.File, error) {
   548  	if c.Stderr != nil && interfaceEqual(c.Stderr, c.Stdout) {
   549  		return childStdout, nil
   550  	}
   551  	return c.writerDescriptor(c.Stderr)
   552  }
   553  
   554  // writerDescriptor returns an os.File to which the child process
   555  // can write to send data to w.
   556  //
   557  // If w is nil, writerDescriptor returns a File that writes to os.DevNull.
   558  func (c *Cmd) writerDescriptor(w io.Writer) (*os.File, error) {
   559  	if w == nil {
   560  		f, err := os.OpenFile(os.DevNull, os.O_WRONLY, 0)
   561  		if err != nil {
   562  			return nil, err
   563  		}
   564  		c.childIOFiles = append(c.childIOFiles, f)
   565  		return f, nil
   566  	}
   567  
   568  	if f, ok := w.(*os.File); ok {
   569  		return f, nil
   570  	}
   571  
   572  	pr, pw, err := os.Pipe()
   573  	if err != nil {
   574  		return nil, err
   575  	}
   576  
   577  	c.childIOFiles = append(c.childIOFiles, pw)
   578  	c.parentIOPipes = append(c.parentIOPipes, pr)
   579  	c.goroutine = append(c.goroutine, func() error {
   580  		_, err := io.Copy(w, pr)
   581  		pr.Close() // in case io.Copy stopped due to write error
   582  		return err
   583  	})
   584  	return pw, nil
   585  }
   586  
   587  func closeDescriptors(closers []io.Closer) {
   588  	for _, fd := range closers {
   589  		fd.Close()
   590  	}
   591  }
   592  
   593  // Run starts the specified command and waits for it to complete.
   594  //
   595  // The returned error is nil if the command runs, has no problems
   596  // copying stdin, stdout, and stderr, and exits with a zero exit
   597  // status.
   598  //
   599  // If the command starts but does not complete successfully, the error is of
   600  // type [*ExitError]. Other error types may be returned for other situations.
   601  //
   602  // If the calling goroutine has locked the operating system thread
   603  // with [runtime.LockOSThread] and modified any inheritable OS-level
   604  // thread state (for example, Linux or Plan 9 name spaces), the new
   605  // process will inherit the caller's thread state.
   606  func (c *Cmd) Run() error {
   607  	if err := c.Start(); err != nil {
   608  		return err
   609  	}
   610  	return c.Wait()
   611  }
   612  
   613  // Start starts the specified command but does not wait for it to complete.
   614  //
   615  // If Start returns successfully, the c.Process field will be set.
   616  //
   617  // After a successful call to Start the [Cmd.Wait] method must be called in
   618  // order to release associated system resources.
   619  func (c *Cmd) Start() error {
   620  	// Check for doubled Start calls before we defer failure cleanup. If the prior
   621  	// call to Start succeeded, we don't want to spuriously close its pipes.
   622  	if c.Process != nil {
   623  		return errors.New("exec: already started")
   624  	}
   625  
   626  	started := false
   627  	defer func() {
   628  		closeDescriptors(c.childIOFiles)
   629  		c.childIOFiles = nil
   630  
   631  		if !started {
   632  			closeDescriptors(c.parentIOPipes)
   633  			c.parentIOPipes = nil
   634  		}
   635  	}()
   636  
   637  	if c.Path == "" && c.Err == nil && c.lookPathErr == nil {
   638  		c.Err = errors.New("exec: no command")
   639  	}
   640  	if c.Err != nil || c.lookPathErr != nil {
   641  		if c.lookPathErr != nil {
   642  			return c.lookPathErr
   643  		}
   644  		return c.Err
   645  	}
   646  	lp := c.Path
   647  	if runtime.GOOS == "windows" {
   648  		if c.Path == c.cachedLookExtensions.in {
   649  			// If Command was called with an absolute path, we already resolved
   650  			// its extension and shouldn't need to do so again (provided c.Path
   651  			// wasn't set to another value between the calls to Command and Start).
   652  			lp = c.cachedLookExtensions.out
   653  		} else {
   654  			// If *Cmd was made without using Command at all, or if Command was
   655  			// called with a relative path, we had to wait until now to resolve
   656  			// it in case c.Dir was changed.
   657  			//
   658  			// Unfortunately, we cannot write the result back to c.Path because programs
   659  			// may assume that they can call Start concurrently with reading the path.
   660  			// (It is safe and non-racy to do so on Unix platforms, and users might not
   661  			// test with the race detector on all platforms;
   662  			// see https://go.dev/issue/62596.)
   663  			//
   664  			// So we will pass the fully resolved path to os.StartProcess, but leave
   665  			// c.Path as is: missing a bit of logging information seems less harmful
   666  			// than triggering a surprising data race, and if the user really cares
   667  			// about that bit of logging they can always use LookPath to resolve it.
   668  			var err error
   669  			lp, err = lookExtensions(c.Path, c.Dir)
   670  			if err != nil {
   671  				return err
   672  			}
   673  		}
   674  	}
   675  	if c.Cancel != nil && c.ctx == nil {
   676  		return errors.New("exec: command with a non-nil Cancel was not created with CommandContext")
   677  	}
   678  	if c.ctx != nil {
   679  		select {
   680  		case <-c.ctx.Done():
   681  			return c.ctx.Err()
   682  		default:
   683  		}
   684  	}
   685  
   686  	childFiles := make([]*os.File, 0, 3+len(c.ExtraFiles))
   687  	stdin, err := c.childStdin()
   688  	if err != nil {
   689  		return err
   690  	}
   691  	childFiles = append(childFiles, stdin)
   692  	stdout, err := c.childStdout()
   693  	if err != nil {
   694  		return err
   695  	}
   696  	childFiles = append(childFiles, stdout)
   697  	stderr, err := c.childStderr(stdout)
   698  	if err != nil {
   699  		return err
   700  	}
   701  	childFiles = append(childFiles, stderr)
   702  	childFiles = append(childFiles, c.ExtraFiles...)
   703  
   704  	env, err := c.environ()
   705  	if err != nil {
   706  		return err
   707  	}
   708  
   709  	c.Process, err = os.StartProcess(lp, c.argv(), &os.ProcAttr{
   710  		Dir:   c.Dir,
   711  		Files: childFiles,
   712  		Env:   env,
   713  		Sys:   c.SysProcAttr,
   714  	})
   715  	if err != nil {
   716  		return err
   717  	}
   718  	started = true
   719  
   720  	// Don't allocate the goroutineErr channel unless there are goroutines to start.
   721  	if len(c.goroutine) > 0 {
   722  		goroutineErr := make(chan error, 1)
   723  		c.goroutineErr = goroutineErr
   724  
   725  		type goroutineStatus struct {
   726  			running  int
   727  			firstErr error
   728  		}
   729  		statusc := make(chan goroutineStatus, 1)
   730  		statusc <- goroutineStatus{running: len(c.goroutine)}
   731  		for _, fn := range c.goroutine {
   732  			go func(fn func() error) {
   733  				err := fn()
   734  
   735  				status := <-statusc
   736  				if status.firstErr == nil {
   737  					status.firstErr = err
   738  				}
   739  				status.running--
   740  				if status.running == 0 {
   741  					goroutineErr <- status.firstErr
   742  				} else {
   743  					statusc <- status
   744  				}
   745  			}(fn)
   746  		}
   747  		c.goroutine = nil // Allow the goroutines' closures to be GC'd when they complete.
   748  	}
   749  
   750  	// If we have anything to do when the command's Context expires,
   751  	// start a goroutine to watch for cancellation.
   752  	//
   753  	// (Even if the command was created by CommandContext, a helper library may
   754  	// have explicitly set its Cancel field back to nil, indicating that it should
   755  	// be allowed to continue running after cancellation after all.)
   756  	if (c.Cancel != nil || c.WaitDelay != 0) && c.ctx != nil && c.ctx.Done() != nil {
   757  		resultc := make(chan ctxResult)
   758  		c.ctxResult = resultc
   759  		go c.watchCtx(resultc)
   760  	}
   761  
   762  	return nil
   763  }
   764  
   765  // watchCtx watches c.ctx until it is able to send a result to resultc.
   766  //
   767  // If c.ctx is done before a result can be sent, watchCtx calls c.Cancel,
   768  // and/or kills cmd.Process it after c.WaitDelay has elapsed.
   769  //
   770  // watchCtx manipulates c.goroutineErr, so its result must be received before
   771  // c.awaitGoroutines is called.
   772  func (c *Cmd) watchCtx(resultc chan<- ctxResult) {
   773  	select {
   774  	case resultc <- ctxResult{}:
   775  		return
   776  	case <-c.ctx.Done():
   777  	}
   778  
   779  	var err error
   780  	if c.Cancel != nil {
   781  		if interruptErr := c.Cancel(); interruptErr == nil {
   782  			// We appear to have successfully interrupted the command, so any
   783  			// program behavior from this point may be due to ctx even if the
   784  			// command exits with code 0.
   785  			err = c.ctx.Err()
   786  		} else if errors.Is(interruptErr, os.ErrProcessDone) {
   787  			// The process already finished: we just didn't notice it yet.
   788  			// (Perhaps c.Wait hadn't been called, or perhaps it happened to race with
   789  			// c.ctx being canceled.) Don't inject a needless error.
   790  		} else {
   791  			err = wrappedError{
   792  				prefix: "exec: canceling Cmd",
   793  				err:    interruptErr,
   794  			}
   795  		}
   796  	}
   797  	if c.WaitDelay == 0 {
   798  		resultc <- ctxResult{err: err}
   799  		return
   800  	}
   801  
   802  	timer := time.NewTimer(c.WaitDelay)
   803  	select {
   804  	case resultc <- ctxResult{err: err, timer: timer}:
   805  		// c.Process.Wait returned and we've handed the timer off to c.Wait.
   806  		// It will take care of goroutine shutdown from here.
   807  		return
   808  	case <-timer.C:
   809  	}
   810  
   811  	killed := false
   812  	if killErr := c.Process.Kill(); killErr == nil {
   813  		// We appear to have killed the process. c.Process.Wait should return a
   814  		// non-nil error to c.Wait unless the Kill signal races with a successful
   815  		// exit, and if that does happen we shouldn't report a spurious error,
   816  		// so don't set err to anything here.
   817  		killed = true
   818  	} else if !errors.Is(killErr, os.ErrProcessDone) {
   819  		err = wrappedError{
   820  			prefix: "exec: killing Cmd",
   821  			err:    killErr,
   822  		}
   823  	}
   824  
   825  	if c.goroutineErr != nil {
   826  		select {
   827  		case goroutineErr := <-c.goroutineErr:
   828  			// Forward goroutineErr only if we don't have reason to believe it was
   829  			// caused by a call to Cancel or Kill above.
   830  			if err == nil && !killed {
   831  				err = goroutineErr
   832  			}
   833  		default:
   834  			// Close the child process's I/O pipes, in case it abandoned some
   835  			// subprocess that inherited them and is still holding them open
   836  			// (see https://go.dev/issue/23019).
   837  			//
   838  			// We close the goroutine pipes only after we have sent any signals we're
   839  			// going to send to the process (via Signal or Kill above): if we send
   840  			// SIGKILL to the process, we would prefer for it to die of SIGKILL, not
   841  			// SIGPIPE. (However, this may still cause any orphaned subprocesses to
   842  			// terminate with SIGPIPE.)
   843  			closeDescriptors(c.parentIOPipes)
   844  			// Wait for the copying goroutines to finish, but report ErrWaitDelay for
   845  			// the error: any other error here could result from closing the pipes.
   846  			_ = <-c.goroutineErr
   847  			if err == nil {
   848  				err = ErrWaitDelay
   849  			}
   850  		}
   851  
   852  		// Since we have already received the only result from c.goroutineErr,
   853  		// set it to nil to prevent awaitGoroutines from blocking on it.
   854  		c.goroutineErr = nil
   855  	}
   856  
   857  	resultc <- ctxResult{err: err}
   858  }
   859  
   860  // An ExitError reports an unsuccessful exit by a command.
   861  type ExitError struct {
   862  	*os.ProcessState
   863  
   864  	// Stderr holds a subset of the standard error output from the
   865  	// Cmd.Output method if standard error was not otherwise being
   866  	// collected.
   867  	//
   868  	// If the error output is long, Stderr may contain only a prefix
   869  	// and suffix of the output, with the middle replaced with
   870  	// text about the number of omitted bytes.
   871  	//
   872  	// Stderr is provided for debugging, for inclusion in error messages.
   873  	// Users with other needs should redirect Cmd.Stderr as needed.
   874  	Stderr []byte
   875  }
   876  
   877  func (e *ExitError) Error() string {
   878  	return e.ProcessState.String()
   879  }
   880  
   881  // Wait waits for the command to exit and waits for any copying to
   882  // stdin or copying from stdout or stderr to complete.
   883  //
   884  // The command must have been started by [Cmd.Start].
   885  //
   886  // The returned error is nil if the command runs, has no problems
   887  // copying stdin, stdout, and stderr, and exits with a zero exit
   888  // status.
   889  //
   890  // If the command fails to run or doesn't complete successfully, the
   891  // error is of type [*ExitError]. Other error types may be
   892  // returned for I/O problems.
   893  //
   894  // If any of c.Stdin, c.Stdout or c.Stderr are not an [*os.File], Wait also waits
   895  // for the respective I/O loop copying to or from the process to complete.
   896  //
   897  // Wait releases any resources associated with the [Cmd].
   898  func (c *Cmd) Wait() error {
   899  	if c.Process == nil {
   900  		return errors.New("exec: not started")
   901  	}
   902  	if c.ProcessState != nil {
   903  		return errors.New("exec: Wait was already called")
   904  	}
   905  
   906  	state, err := c.Process.Wait()
   907  	if err == nil && !state.Success() {
   908  		err = &ExitError{ProcessState: state}
   909  	}
   910  	c.ProcessState = state
   911  
   912  	var timer *time.Timer
   913  	if c.ctxResult != nil {
   914  		watch := <-c.ctxResult
   915  		timer = watch.timer
   916  		// If c.Process.Wait returned an error, prefer that.
   917  		// Otherwise, report any error from the watchCtx goroutine,
   918  		// such as a Context cancellation or a WaitDelay overrun.
   919  		if err == nil && watch.err != nil {
   920  			err = watch.err
   921  		}
   922  	}
   923  
   924  	if goroutineErr := c.awaitGoroutines(timer); err == nil {
   925  		// Report an error from the copying goroutines only if the program otherwise
   926  		// exited normally on its own. Otherwise, the copying error may be due to the
   927  		// abnormal termination.
   928  		err = goroutineErr
   929  	}
   930  	closeDescriptors(c.parentIOPipes)
   931  	c.parentIOPipes = nil
   932  
   933  	return err
   934  }
   935  
   936  // awaitGoroutines waits for the results of the goroutines copying data to or
   937  // from the command's I/O pipes.
   938  //
   939  // If c.WaitDelay elapses before the goroutines complete, awaitGoroutines
   940  // forcibly closes their pipes and returns ErrWaitDelay.
   941  //
   942  // If timer is non-nil, it must send to timer.C at the end of c.WaitDelay.
   943  func (c *Cmd) awaitGoroutines(timer *time.Timer) error {
   944  	defer func() {
   945  		if timer != nil {
   946  			timer.Stop()
   947  		}
   948  		c.goroutineErr = nil
   949  	}()
   950  
   951  	if c.goroutineErr == nil {
   952  		return nil // No running goroutines to await.
   953  	}
   954  
   955  	if timer == nil {
   956  		if c.WaitDelay == 0 {
   957  			return <-c.goroutineErr
   958  		}
   959  
   960  		select {
   961  		case err := <-c.goroutineErr:
   962  			// Avoid the overhead of starting a timer.
   963  			return err
   964  		default:
   965  		}
   966  
   967  		// No existing timer was started: either there is no Context associated with
   968  		// the command, or c.Process.Wait completed before the Context was done.
   969  		timer = time.NewTimer(c.WaitDelay)
   970  	}
   971  
   972  	select {
   973  	case <-timer.C:
   974  		closeDescriptors(c.parentIOPipes)
   975  		// Wait for the copying goroutines to finish, but ignore any error
   976  		// (since it was probably caused by closing the pipes).
   977  		_ = <-c.goroutineErr
   978  		return ErrWaitDelay
   979  
   980  	case err := <-c.goroutineErr:
   981  		return err
   982  	}
   983  }
   984  
   985  // Output runs the command and returns its standard output.
   986  // Any returned error will usually be of type [*ExitError].
   987  // If c.Stderr was nil, Output populates [ExitError.Stderr].
   988  func (c *Cmd) Output() ([]byte, error) {
   989  	if c.Stdout != nil {
   990  		return nil, errors.New("exec: Stdout already set")
   991  	}
   992  	var stdout bytes.Buffer
   993  	c.Stdout = &stdout
   994  
   995  	captureErr := c.Stderr == nil
   996  	if captureErr {
   997  		c.Stderr = &prefixSuffixSaver{N: 32 << 10}
   998  	}
   999  
  1000  	err := c.Run()
  1001  	if err != nil && captureErr {
  1002  		if ee, ok := err.(*ExitError); ok {
  1003  			ee.Stderr = c.Stderr.(*prefixSuffixSaver).Bytes()
  1004  		}
  1005  	}
  1006  	return stdout.Bytes(), err
  1007  }
  1008  
  1009  // CombinedOutput runs the command and returns its combined standard
  1010  // output and standard error.
  1011  func (c *Cmd) CombinedOutput() ([]byte, error) {
  1012  	if c.Stdout != nil {
  1013  		return nil, errors.New("exec: Stdout already set")
  1014  	}
  1015  	if c.Stderr != nil {
  1016  		return nil, errors.New("exec: Stderr already set")
  1017  	}
  1018  	var b bytes.Buffer
  1019  	c.Stdout = &b
  1020  	c.Stderr = &b
  1021  	err := c.Run()
  1022  	return b.Bytes(), err
  1023  }
  1024  
  1025  // StdinPipe returns a pipe that will be connected to the command's
  1026  // standard input when the command starts.
  1027  // The pipe will be closed automatically after [Cmd.Wait] sees the command exit.
  1028  // A caller need only call Close to force the pipe to close sooner.
  1029  // For example, if the command being run will not exit until standard input
  1030  // is closed, the caller must close the pipe.
  1031  func (c *Cmd) StdinPipe() (io.WriteCloser, error) {
  1032  	if c.Stdin != nil {
  1033  		return nil, errors.New("exec: Stdin already set")
  1034  	}
  1035  	if c.Process != nil {
  1036  		return nil, errors.New("exec: StdinPipe after process started")
  1037  	}
  1038  	pr, pw, err := os.Pipe()
  1039  	if err != nil {
  1040  		return nil, err
  1041  	}
  1042  	c.Stdin = pr
  1043  	c.childIOFiles = append(c.childIOFiles, pr)
  1044  	c.parentIOPipes = append(c.parentIOPipes, pw)
  1045  	return pw, nil
  1046  }
  1047  
  1048  // StdoutPipe returns a pipe that will be connected to the command's
  1049  // standard output when the command starts.
  1050  //
  1051  // [Cmd.Wait] will close the pipe after seeing the command exit, so most callers
  1052  // need not close the pipe themselves. It is thus incorrect to call Wait
  1053  // before all reads from the pipe have completed.
  1054  // For the same reason, it is incorrect to call [Cmd.Run] when using StdoutPipe.
  1055  // See the example for idiomatic usage.
  1056  func (c *Cmd) StdoutPipe() (io.ReadCloser, error) {
  1057  	if c.Stdout != nil {
  1058  		return nil, errors.New("exec: Stdout already set")
  1059  	}
  1060  	if c.Process != nil {
  1061  		return nil, errors.New("exec: StdoutPipe after process started")
  1062  	}
  1063  	pr, pw, err := os.Pipe()
  1064  	if err != nil {
  1065  		return nil, err
  1066  	}
  1067  	c.Stdout = pw
  1068  	c.childIOFiles = append(c.childIOFiles, pw)
  1069  	c.parentIOPipes = append(c.parentIOPipes, pr)
  1070  	return pr, nil
  1071  }
  1072  
  1073  // StderrPipe returns a pipe that will be connected to the command's
  1074  // standard error when the command starts.
  1075  //
  1076  // [Cmd.Wait] will close the pipe after seeing the command exit, so most callers
  1077  // need not close the pipe themselves. It is thus incorrect to call Wait
  1078  // before all reads from the pipe have completed.
  1079  // For the same reason, it is incorrect to use [Cmd.Run] when using StderrPipe.
  1080  // See the StdoutPipe example for idiomatic usage.
  1081  func (c *Cmd) StderrPipe() (io.ReadCloser, error) {
  1082  	if c.Stderr != nil {
  1083  		return nil, errors.New("exec: Stderr already set")
  1084  	}
  1085  	if c.Process != nil {
  1086  		return nil, errors.New("exec: StderrPipe after process started")
  1087  	}
  1088  	pr, pw, err := os.Pipe()
  1089  	if err != nil {
  1090  		return nil, err
  1091  	}
  1092  	c.Stderr = pw
  1093  	c.childIOFiles = append(c.childIOFiles, pw)
  1094  	c.parentIOPipes = append(c.parentIOPipes, pr)
  1095  	return pr, nil
  1096  }
  1097  
  1098  // prefixSuffixSaver is an io.Writer which retains the first N bytes
  1099  // and the last N bytes written to it. The Bytes() methods reconstructs
  1100  // it with a pretty error message.
  1101  type prefixSuffixSaver struct {
  1102  	N         int // max size of prefix or suffix
  1103  	prefix    []byte
  1104  	suffix    []byte // ring buffer once len(suffix) == N
  1105  	suffixOff int    // offset to write into suffix
  1106  	skipped   int64
  1107  
  1108  	// TODO(bradfitz): we could keep one large []byte and use part of it for
  1109  	// the prefix, reserve space for the '... Omitting N bytes ...' message,
  1110  	// then the ring buffer suffix, and just rearrange the ring buffer
  1111  	// suffix when Bytes() is called, but it doesn't seem worth it for
  1112  	// now just for error messages. It's only ~64KB anyway.
  1113  }
  1114  
  1115  func (w *prefixSuffixSaver) Write(p []byte) (n int, err error) {
  1116  	lenp := len(p)
  1117  	p = w.fill(&w.prefix, p)
  1118  
  1119  	// Only keep the last w.N bytes of suffix data.
  1120  	if overage := len(p) - w.N; overage > 0 {
  1121  		p = p[overage:]
  1122  		w.skipped += int64(overage)
  1123  	}
  1124  	p = w.fill(&w.suffix, p)
  1125  
  1126  	// w.suffix is full now if p is non-empty. Overwrite it in a circle.
  1127  	for len(p) > 0 { // 0, 1, or 2 iterations.
  1128  		n := copy(w.suffix[w.suffixOff:], p)
  1129  		p = p[n:]
  1130  		w.skipped += int64(n)
  1131  		w.suffixOff += n
  1132  		if w.suffixOff == w.N {
  1133  			w.suffixOff = 0
  1134  		}
  1135  	}
  1136  	return lenp, nil
  1137  }
  1138  
  1139  // fill appends up to len(p) bytes of p to *dst, such that *dst does not
  1140  // grow larger than w.N. It returns the un-appended suffix of p.
  1141  func (w *prefixSuffixSaver) fill(dst *[]byte, p []byte) (pRemain []byte) {
  1142  	if remain := w.N - len(*dst); remain > 0 {
  1143  		add := min(len(p), remain)
  1144  		*dst = append(*dst, p[:add]...)
  1145  		p = p[add:]
  1146  	}
  1147  	return p
  1148  }
  1149  
  1150  func (w *prefixSuffixSaver) Bytes() []byte {
  1151  	if w.suffix == nil {
  1152  		return w.prefix
  1153  	}
  1154  	if w.skipped == 0 {
  1155  		return append(w.prefix, w.suffix...)
  1156  	}
  1157  	var buf bytes.Buffer
  1158  	buf.Grow(len(w.prefix) + len(w.suffix) + 50)
  1159  	buf.Write(w.prefix)
  1160  	buf.WriteString("\n... omitting ")
  1161  	buf.WriteString(strconv.FormatInt(w.skipped, 10))
  1162  	buf.WriteString(" bytes ...\n")
  1163  	buf.Write(w.suffix[w.suffixOff:])
  1164  	buf.Write(w.suffix[:w.suffixOff])
  1165  	return buf.Bytes()
  1166  }
  1167  
  1168  // environ returns a best-effort copy of the environment in which the command
  1169  // would be run as it is currently configured. If an error occurs in computing
  1170  // the environment, it is returned alongside the best-effort copy.
  1171  func (c *Cmd) environ() ([]string, error) {
  1172  	var err error
  1173  
  1174  	env := c.Env
  1175  	if env == nil {
  1176  		env, err = execenv.Default(c.SysProcAttr)
  1177  		if err != nil {
  1178  			env = os.Environ()
  1179  			// Note that the non-nil err is preserved despite env being overridden.
  1180  		}
  1181  
  1182  		if c.Dir != "" {
  1183  			switch runtime.GOOS {
  1184  			case "windows", "plan9":
  1185  				// Windows and Plan 9 do not use the PWD variable, so we don't need to
  1186  				// keep it accurate.
  1187  			default:
  1188  				// On POSIX platforms, PWD represents “an absolute pathname of the
  1189  				// current working directory.” Since we are changing the working
  1190  				// directory for the command, we should also update PWD to reflect that.
  1191  				//
  1192  				// Unfortunately, we didn't always do that, so (as proposed in
  1193  				// https://go.dev/issue/50599) to avoid unintended collateral damage we
  1194  				// only implicitly update PWD when Env is nil. That way, we're much
  1195  				// less likely to override an intentional change to the variable.
  1196  				if pwd, absErr := filepath.Abs(c.Dir); absErr == nil {
  1197  					env = append(env, "PWD="+pwd)
  1198  				} else if err == nil {
  1199  					err = absErr
  1200  				}
  1201  			}
  1202  		}
  1203  	}
  1204  
  1205  	env, dedupErr := dedupEnv(env)
  1206  	if err == nil {
  1207  		err = dedupErr
  1208  	}
  1209  	return addCriticalEnv(env), err
  1210  }
  1211  
  1212  // Environ returns a copy of the environment in which the command would be run
  1213  // as it is currently configured.
  1214  func (c *Cmd) Environ() []string {
  1215  	//  Intentionally ignore errors: environ returns a best-effort environment no matter what.
  1216  	env, _ := c.environ()
  1217  	return env
  1218  }
  1219  
  1220  // dedupEnv returns a copy of env with any duplicates removed, in favor of
  1221  // later values.
  1222  // Items not of the normal environment "key=value" form are preserved unchanged.
  1223  // Except on Plan 9, items containing NUL characters are removed, and
  1224  // an error is returned along with the remaining values.
  1225  func dedupEnv(env []string) ([]string, error) {
  1226  	return dedupEnvCase(runtime.GOOS == "windows", runtime.GOOS == "plan9", env)
  1227  }
  1228  
  1229  // dedupEnvCase is dedupEnv with a case option for testing.
  1230  // If caseInsensitive is true, the case of keys is ignored.
  1231  // If nulOK is false, items containing NUL characters are allowed.
  1232  func dedupEnvCase(caseInsensitive, nulOK bool, env []string) ([]string, error) {
  1233  	// Construct the output in reverse order, to preserve the
  1234  	// last occurrence of each key.
  1235  	var err error
  1236  	out := make([]string, 0, len(env))
  1237  	saw := make(map[string]bool, len(env))
  1238  	for n := len(env); n > 0; n-- {
  1239  		kv := env[n-1]
  1240  
  1241  		// Reject NUL in environment variables to prevent security issues (#56284);
  1242  		// except on Plan 9, which uses NUL as os.PathListSeparator (#56544).
  1243  		if !nulOK && strings.IndexByte(kv, 0) != -1 {
  1244  			err = errors.New("exec: environment variable contains NUL")
  1245  			continue
  1246  		}
  1247  
  1248  		i := strings.Index(kv, "=")
  1249  		if i == 0 {
  1250  			// We observe in practice keys with a single leading "=" on Windows.
  1251  			// TODO(#49886): Should we consume only the first leading "=" as part
  1252  			// of the key, or parse through arbitrarily many of them until a non-"="?
  1253  			i = strings.Index(kv[1:], "=") + 1
  1254  		}
  1255  		if i < 0 {
  1256  			if kv != "" {
  1257  				// The entry is not of the form "key=value" (as it is required to be).
  1258  				// Leave it as-is for now.
  1259  				// TODO(#52436): should we strip or reject these bogus entries?
  1260  				out = append(out, kv)
  1261  			}
  1262  			continue
  1263  		}
  1264  		k := kv[:i]
  1265  		if caseInsensitive {
  1266  			k = strings.ToLower(k)
  1267  		}
  1268  		if saw[k] {
  1269  			continue
  1270  		}
  1271  
  1272  		saw[k] = true
  1273  		out = append(out, kv)
  1274  	}
  1275  
  1276  	// Now reverse the slice to restore the original order.
  1277  	for i := 0; i < len(out)/2; i++ {
  1278  		j := len(out) - i - 1
  1279  		out[i], out[j] = out[j], out[i]
  1280  	}
  1281  
  1282  	return out, err
  1283  }
  1284  
  1285  // addCriticalEnv adds any critical environment variables that are required
  1286  // (or at least almost always required) on the operating system.
  1287  // Currently this is only used for Windows.
  1288  func addCriticalEnv(env []string) []string {
  1289  	if runtime.GOOS != "windows" {
  1290  		return env
  1291  	}
  1292  	for _, kv := range env {
  1293  		k, _, ok := strings.Cut(kv, "=")
  1294  		if !ok {
  1295  			continue
  1296  		}
  1297  		if strings.EqualFold(k, "SYSTEMROOT") {
  1298  			// We already have it.
  1299  			return env
  1300  		}
  1301  	}
  1302  	return append(env, "SYSTEMROOT="+os.Getenv("SYSTEMROOT"))
  1303  }
  1304  
  1305  // ErrDot indicates that a path lookup resolved to an executable
  1306  // in the current directory due to ‘.’ being in the path, either
  1307  // implicitly or explicitly. See the package documentation for details.
  1308  //
  1309  // Note that functions in this package do not return ErrDot directly.
  1310  // Code should use errors.Is(err, ErrDot), not err == ErrDot,
  1311  // to test whether a returned error err is due to this condition.
  1312  var ErrDot = errors.New("cannot run executable found relative to current directory")
  1313  

View as plain text