Skip to content

gh-148315: Shell-quote the command line in pyvenv.cfg#148368

Open
pratyush618 wants to merge 3 commits intopython:mainfrom
pratyush618:fix-gh-148315-venv-command-quoting
Open

gh-148315: Shell-quote the command line in pyvenv.cfg#148368
pratyush618 wants to merge 3 commits intopython:mainfrom
pratyush618:fix-gh-148315-venv-command-quoting

Conversation

@pratyush618
Copy link
Copy Markdown

Summary

  • venv.EnvBuilder.create_configuration built the command = ... record in pyvenv.cfg with ' '.join(args) and an unquoted sys.executable. When any token contained whitespace (for example a Windows user directory like C:\Users\Z B\...), the recorded command was no longer a faithful reproduction and truncated at the first space when shell-parsed — exactly what the reporter of 3.14.4 venv breaks with --system-site-packages if Windows username has a space in it #148315 observed.
  • Build the full argv as a list and emit it via shlex.join, and split --prompt="..." into two argv tokens so its value is quoted by shlex.join too.
  • Update _check_output_of_default_create and test_config_file_command_key for the new format and add test_config_file_command_quotes_paths_with_spaces to lock in the regression.

Out of scope

The reporter also described a second venv being created at ./--system-site-packages/. I could not trace a code path that causes that purely from reading the source — the command = line itself is not executed by getpath.py, site.py, or PC/venvlauncher.c. If the reporter re-tests with this patch and still sees the stray venv, a PYLAUNCHER_DEBUG=1 trace should be gathered and tracked as a follow-up.

Test plan

  • ./python -m test test_venv -v
  • Manually: ./python -m venv "/tmp/with space venv" && grep '^command' "/tmp/with space venv/pyvenv.cfg" — right-hand side of command = should round-trip through shlex.split as a single token.
  • Re-run the copy-pasted command from pyvenv.cfg in a shell and confirm it recreates an equivalent venv.

@pratyush618 pratyush618 requested a review from vsajip as a code owner April 11, 2026 07:48
@python-cla-bot
Copy link
Copy Markdown

python-cla-bot bot commented Apr 11, 2026

All commit authors signed the Contributor License Agreement.

CLA signed

The `command = ...` record written to `pyvenv.cfg` by
`venv.EnvBuilder.create_configuration` was assembled with a plain
`' '.join(args)` and an unquoted `sys.executable`. When any of these
tokens contained whitespace (for example a Windows user directory like
`C:\Users\Z B\...`), the recorded command was no longer a faithful
reproduction and truncated at the first space when shell-parsed.

Build the full argv as a list and emit it via `shlex.join`, and split
`--prompt="..."` into two separate argv tokens so its value is quoted
by `shlex.join` as well.
@pratyush618 pratyush618 force-pushed the fix-gh-148315-venv-command-quoting branch from ec004ad to a8202d9 Compare April 11, 2026 08:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant