env: fix only long options are allowed to contain '='

src/uu/env/src/env.rs

@@ -370,6 +370,19 @@ impl EnvAppData {
                     self.had_string_argument = true;
                 }
                 _ => {
+                    let arg_str = arg.to_string_lossy();
+
+                    // Short unset option (-u) is not allowed to contain '='
+                    if arg_str.contains('=')
+                        && arg_str.starts_with("-u")
+                        && !arg_str.starts_with("--")
+                    {
+                        return Err(USimpleError::new(
+                            125,
+                            format!("cannot unset '{}': Invalid argument", &arg_str[2..]),
+                        ));
+                    }
+
                     all_args.push(arg.clone());
                 }
             }

tests/by-util/test_env.rs

@@ -882,6 +882,29 @@ fn test_env_arg_ignore_signal_empty() {
         .no_stderr()
         .stdout_contains("hello");
 }
+
+#[test]
+fn disallow_equals_sign_on_short_unset_option() {
+    let ts = TestScenario::new(util_name!());
+
+    ts.ucmd()
+        .arg("-u=")
+        .fails()
+        .code_is(125)
+        .stderr_contains("env: cannot unset '=': Invalid argument");
+    ts.ucmd()
+        .arg("-u=A1B2C3")
+        .fails()
+        .code_is(125)
+        .stderr_contains("env: cannot unset '=A1B2C3': Invalid argument");
+    ts.ucmd().arg("--split-string=A1B=2C3=").succeeds();
+    ts.ucmd()
+        .arg("--unset=")
+        .fails()
+        .code_is(125)
+        .stderr_contains("env: cannot unset '': Invalid argument");
+}
+
 #[cfg(test)]
 mod tests_split_iterator {