Merge commit 'refs/pull/14907/head' of git://github.com/NixOS/nixpkgs into staging

doc/stdenv.xml

···
 echo @foo@
 </programlisting>
 
-    That is, no substitution is performed for undefined variables.</para></listitem>
+    That is, no substitution is performed for undefined variables.</para>
+
+    <para>Environment variables that start with an uppercase letter are filtered out,
+    to prevent global variables (like <literal>HOME</literal>) from accidentally
+    getting substituted.
+    The variables also have to be valid bash “names”, as
+    defined in the bash manpage (alphanumeric or <literal>_</literal>, must not
+    start with a number).</para>
+  </listitem>
   </varlistentry>
 
 

pkgs/build-support/substitute/substitute-all.nix

···
 
 args:
 
+# see the substituteAll in the nixpkgs documentation for usage and constaints
 stdenv.mkDerivation ({
   name = if args ? name then args.name else baseNameOf (toString args.src);
   builder = ./substitute-all.sh;

pkgs/stdenv/generic/setup.sh

···
 
         if [ "$p" = --subst-var ]; then
             varName="${params[$((n + 1))]}"
+            # check if the used nix attribute name is a valid bash name
+            if ! [[ "$varName" =~ ^[a-zA-Z_]+[a-zA-Z0-9_]*$ ]]; then
+                echo "substitution variables must be valid bash names, \"$varName\" isn't."
+                exit 1;
+            fi
             pattern="@$varName@"
             replacement="${!varName}"
             n=$((n + 1))
···
     local output="$2"
 
     # Select all environment variables that start with a lowercase character.
-    for envVar in $(env | sed -e $'s/^\([a-z][^=]*\)=.*/\\1/; t \n d'); do
+    # Will not work with nix attribute names (and thus env variables) containing '\n'.
+    for envVar in $(set | sed -e $'s/^\([a-z][^=]*\)=.*/\\1/; t \n d'); do
         if [ "$NIX_DEBUG" = "1" ]; then
             echo "$envVar -> ${!envVar}"
         fi