Could PATH contain newlines?

Question

It is known that a path could contain newlines in any of its components.

Should we conclude then that the environment variable $PATH could contain newlines ?

If so, how to split the $PATH into its elements, similar to (Bourne like):

    IFS=':' ; set -f
    for var in $PATH
    do
        echo "<$var>"
    done

But if it could be done without changing IFS, even better.

Answer 1

In POSIX shells, $IFS is a field delimiter, not separator, so a $PATH value like /bin:/usr/bin: would be split into /bin and /usr/bin instead of /bin, /usr/bin and the empty string (meaning the current directory). You need:

IFS=:; set -o noglob
for var in $PATH""; do
  printf '<%s>\n' "$var"
done

To avoid modifying global settings, you can use a shell with explicit splitting operators like zsh:

for var in "${(s/:/@)PATH}"; do
  printf '<%s>\n' "$var"
done

Though in that case, zsh already has the $path array tied to $PATH like in csh/tcsh, so:

for var in "$path[@]"; do
  printf '<%s>\n' "$var"
done

In any case, yes, in theory $PATH like any variable could contain newline characters, the newline character is not special in any way when it comes to file path resolution. I don't expect anyone sensible would put a directory with newline (or wildcards) in their $PATH or name a command with newline in its name. It's also hard to imagine a scenario where someone could exploit a script that makes the assumption that $PATH won't contain newline characters.

Answer 2

Yes, PATH can contain newlines (even on ancient Unix system).

As to splitting any string in shell, the only way you can do it portably is with IFS. You can use IFS=:; set -f; set -- $PATH or pass it to a function instead of looping with for, though.

With bash you can also "read" a string into an array:

xtra=$'some\nother\nplace\n\n'; PATH="$PATH:$xtra"
mapfile -td: path < <(printf %s "$PATH")
printf '<%s>\n' "${path[@]}"

But using arrays is usually not a good idea, because they can't be stored transparently in environment variables or passed as a single argument to external commands.

Notice that IFS will terminate fields, not separate them (kind of like \n at the end of the file won't be treated like an empty line by programs reading the file line-by-line); if that's not what's expected, and you really want to create an extra empty field at the end when splitting a string that ends in a character from IFS, you should join an empty string after the variable that is subject to word splitting:

(P=/bin:; IFS=:; printf '<%s>\n' $P"")
</bin>
<>

The word splitting algorithm will also ignore white space characters at the beginning of the string, if those whitespace characters are part of IFS. If you want an extra field for the leading whitespace, you should also join an empty string before the variable:

(P='   foo : bar  '; IFS=': '; set -f; set -- $P; printf '<%s>\n' "$@")
<foo>
<bar>

(P='   foo : bar  '; IFS=': '; set -f; set -- ""$P""; printf '<%s>\n' "$@")
<>
<foo>
<bar>
<>