{"record":{"id":"b95a5c3517319a22","repo":"fyne-io/fyne","slug":"malformed-env-var-q-from-input","errorCode":null,"errorMessage":"malformed env var %q from input","messagePattern":"malformed env var %q from input","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/fyne/internal/mobile/env.go","lineNumber":315,"sourceCode":"\n\tenvs := make(map[string]string, len(cur))\n\tfor _, ev := range cur {\n\t\telem := strings.SplitN(ev, \"=\", 2)\n\t\tif len(elem) != 2 || elem[0] == \"\" {\n\t\t\t// pass the env var of unusual form untouched.\n\t\t\t// e.g. Windows may have env var names starting with \"=\".\n\t\t\tnew = append(new, ev)\n\t\t\tcontinue\n\t\t}\n\t\tif goos == \"windows\" {\n\t\t\telem[0] = strings.ToUpper(elem[0])\n\t\t}\n\t\tenvs[elem[0]] = elem[1]\n\t}\n\tfor _, ev := range kv {\n\t\telem := strings.SplitN(ev, \"=\", 2)\n\t\tif len(elem) != 2 || elem[0] == \"\" {\n\t\t\tpanic(fmt.Sprintf(\"malformed env var %q from input\", ev))\n\t\t}\n\t\tif goos == \"windows\" {\n\t\t\telem[0] = strings.ToUpper(elem[0])\n\t\t}\n\t\tenvs[elem[0]] = elem[1]\n\t}\n\tfor k, v := range envs {\n\t\tnew = append(new, k+\"=\"+v)\n\t}\n\treturn new\n}\n\nfunc archNDK() string {\n\tif runtime.GOOS == \"windows\" && runtime.GOARCH == \"386\" {\n\t\treturn \"windows\"\n\t}\n\n\tvar arch string","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/fyne-io/fyne/blob/8860ee95c356385effa5a7be51adb11c6be9d2b6/cmd/fyne/internal/mobile/env.go#L297-L333","documentation":"environ(kv) merges the process environment with caller-supplied KEY=VALUE strings used for the gomobile build env (CC, CGO_CFLAGS, GOARM, ...). Entries coming from os.Environ of unusual form are passed through untouched, but every kv entry is treated as trusted input and must contain '=' with a non-empty key; anything else panics so it cannot silently corrupt the child build environment.","triggerScenarios":"Passing an env slice containing an entry without '=' (e.g. 'CGO_CFLAGS') or with an empty name (e.g. '=foo') into environ - usually via custom build scripts or CI that assembles the variable list by string concatenation.","commonSituations":"Env lists built by concatenation where a value or '=' was dropped; env files with trailing newlines splitting 'A=b' into 'A=b' plus a fragment; CI matrix variables with missing separators.","solutions":["Fix the offending entry to KEY=VALUE form - the panic message prints the exact malformed string","Filter the slice before passing it: drop empty strings and entries without '=' or with an empty key","Audit env/CI files for stray newlines or quotes feeding the build script"],"exampleFix":"// before\nkv := []string{\"CGO_CFLAGS\", \"CGO_ENABLED=1\"}\n\n// after\nkv := []string{\"CGO_CFLAGS=-O2\", \"CGO_ENABLED=1\"}","handlingStrategy":"validation","validationCode":"// Pre-flight: sanitize env pairs before passing them to the build environment.\nfunc sanitizeEnv(kv []string) ([]string, error) {\n    out := make([]string, 0, len(kv))\n    for _, ev := range kv {\n        if ev == \"\" { continue }\n        k, v, ok := strings.Cut(ev, \"=\")\n        if !ok || k == \"\" { return nil, fmt.Errorf(\"malformed env var %q\", ev) }\n        out = append(out, k+\"=\"+v)\n    }\n    return out, nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Build env lists with explicit key=value constants, not string concatenation","Trim whitespace/newlines when parsing env files into slices","Unit-test your env assembly helper for entries missing '='"],"tags":["env-vars","build","validation","mobile","go"],"backgroundTag":null,"analyzedSha":"8860ee95c356385effa5a7be51adb11c6be9d2b6","analyzedAt":"2026-08-15T22:01:51.624Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}