gh-124651: Quote template strings in venv activation scripts

[y5c4l3]

This patch properly quotes template strings in venv activation scripts. This mitigates potential command injection.

• Issue: [CVE-2024-9287] venv activation scripts do not quote strings properly #124651

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @vsajip for commit 3034419 🤖

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

[y5c4l3]

buildbot/AMD64 FreeBSD failed because bash was not found. I will add a test for tcsh / csh and skip the original test if bash is not present.

======================================================================
ERROR: test_special_chars (test.test_venv.BasicTest.test_special_chars)
Test that the template strings are quoted properly
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/test/test_venv.py", line 515, in test_special_chars
    out, err = check_output([bash, test_script])
               ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/test/test_venv.py", line 50, in check_output
    p = subprocess.Popen(cmd,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        env={**os.environ, "PYTHONHOME": ""})
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/subprocess.py", line 1035, in __init__
    self._execute_child(args, executable, preexec_fn, close_fds,
    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                        pass_fds, cwd, env,
                        ^^^^^^^^^^^^^^^^^^^
    ...<5 lines>...
                        gid, gids, uid, umask,
                        ^^^^^^^^^^^^^^^^^^^^^^
                        start_new_session, process_group)
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/subprocess.py", line 1885, in _execute_child
    executable = os.fsencode(executable)
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/os.py", line 852, in fsencode
    filename = fspath(filename)  # Does type-checking of `filename`.
TypeError: expected str, bytes or os.PathLike object, not NoneType

----------------------------------------------------------------------
Ran 36 tests in 7.578s

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @vsajip for commit b6a3bbd 🤖

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

[y5c4l3]

@vsajip Some tests were still failing but none of them is related to this PR I guess.

[y5c4l3]

@vsajip Summary of the failing tests are posted here. Since they all appeared repeatedly before or after this build, I think this PR is good to go... no?

AMD64 Arch Linux TraceRefs PR/1443

FAIL: test_audit_subinterpreter (test.test_embed.AuditingTests.test_audit_subinterpreter)

iOS ARM64 Simulator PR/136

FAIL: test_alt_digits_nl_langinfo (test.test__locale._LocaleTests.test_alt_digits_nl_langinfo) (locale='ja_JP')

x86 Debian Installed with X PR/27
x86 Debian Non-Debug with X PR/27

make: *** [Makefile:1534: Modules/_hacl/Hacl_Hash_Blake2s_Simd128.o] Error 1
make: *** Waiting for unfinished jobs....

[miss-islington-app]

Thanks @y5c4l3 for the PR, and @vsajip for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

[miss-islington-app]

Thanks @y5c4l3 for the PR, and @vsajip for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

[miss-islington-app]

Sorry, @y5c4l3 and @vsajip, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker d48cc82ed25e26b02eb97c6263d95dcaa1e9111b 3.12

[bedevere-app]

GH-125813 is a backport of this pull request to the 3.13 branch.

[bedevere-app]

GH-126185 is a backport of this pull request to the 3.12 branch.