[3.12] gh-124651: Quote template strings in venv activation scripts (GH-124712)

[ajayk]

…4712)

This patch properly quotes template strings in venv activation scripts. This mitigates potential command injection.

(cherry picked from commit d48cc82)

• Issue: [CVE-2024-9287] venv activation scripts do not quote strings properly #124651

[vsajip]

@ajayk please look into the build failures, I'll review once all tests are passing.

[mcepl]

When applying this patch to 3.12.7, I get this error:

[  774s] 0:02:16 load avg: 2.76 Re-running 1 failed tests in verbose mode in subprocesses
[  774s] 0:02:16 load avg: 2.76 Run 1 test in parallel using 1 worker process (timeout: 1 hour 30 min, worker timeout: 1 hour 35 min)
[  775s] 0:02:16 load avg: 2.76 [1/1/1] test_venv failed (1 error)
[  775s] Re-running test_venv in verbose mode (matching: test_special_chars_bash)
[  775s] test_special_chars_bash (test.test_venv.BasicTest.test_special_chars_bash)
[  775s] Test that the template strings are quoted properly (bash) ... ERROR
[  775s] 
[  775s] ======================================================================
[  775s] ERROR: test_special_chars_bash (test.test_venv.BasicTest.test_special_chars_bash)
[  775s] Test that the template strings are quoted properly (bash)
[  775s] ----------------------------------------------------------------------
[  775s] Traceback (most recent call last):
[  775s]   File "/home/abuild/rpmbuild/BUILD/Python-3.12.7/Lib/test/test_venv.py", line 477, in test_special_chars_bash
[  775s]     self.assertTrue(env_name.encode() in lines[0])
[  775s]                                          ~~~~~^^^
[  775s] IndexError: list index out of range
[  775s] 
[  775s] ----------------------------------------------------------------------
[  775s] Ran 1 test in 0.021s
[  775s] 
[  775s] FAILED (errors=1)

Complete build log with all packages used and steps taken to reproduce.

[vsajip]

I've converted to draft for now, can be made ready for review once the errors are resolved.

[ajayk]

@ajayk please look into the build failures, I'll review once all tests are passing.

on it

[picnixz]

Closing this one since it was superseeded by #126185.