cf curl v3/apps/:guid/env panics on certain env var values #3594
Description
Please fill out the issue checklist below and provide ALL the requested information.
- I reviewed open and closed github issues that may be related to my problem.
- I tried updating to the latest version of the CF CLI to see if it fixed my problem.
- I attempted to run the command with
CF_TRACE=1to help debug the issue. - I am reporting a bug that others will be able to reproduce.
Describe the bug and the command you saw an issue with
cf curl v3/apps/:guid/env panics on certain env var values and/or service binding credentials (e.g. containing {{, }} and also certain backslash combinations).
What happened
cf curl "/v3/apps/$(cf app myapp --guid)/env"
Something unexpected happened. This is a bug in cf.
Please re-run the command that caused this exception with the environment
variable CF_TRACE set to true.
Also, please update to the latest cli and try the command again:
https://code.cloudfoundry.org/cli/releases
Please create an issue at: https://code.cloudfoundry.org/cli/issues
Include the below information when creating the issue:
Command
cf curl /v3/apps/4afcaeb4-1fdd-4cf0-9ac2-7c4914c2a682/env
CLI Version
8.16.0+4b92b73.2025-09-18
Error
template: Display Text:1: bad character U+0022 '"'
Stack Trace
goroutine 1 [running]:
code.cloudfoundry.org/cli/util/panichandler.HandlePanic()
/Users/runner/work/cli/cli/util/panichandler/handler.go:19 +0x48
panic({0x1035762a0?, 0x1400049a690?})
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/runtime/panic.go:783 +0x120
text/template.Must(...)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/text/template/helper.go:26
code.cloudfoundry.org/cli/util/ui.generateTranslationFunc.func1({0x140001a2600, 0x2cd}, {0x1400049a620, 0x1, 0x300?})
/Users/runner/work/cli/cli/util/ui/i18n.go:119 +0x284
code.cloudfoundry.org/cli/util/ui.(*UI).TranslateText(...)
/Users/runner/work/cli/cli/util/ui/ui.go:418
code.cloudfoundry.org/cli/util/ui.(*UI).DisplayText(0x140001588f0, {0x140001a2600, 0x2cd}, {0x0?, 0x14000595858?, 0x0?})
/Users/runner/work/cli/cli/util/ui/ui.go:248 +0x13c
code.cloudfoundry.org/cli/command/v7.CurlCommand.Execute({{{0x10379b030, 0x140001588f0}, {0x10379d500, 0x1400003c388}, {0x10378c588, 0x1400011ea00}, {0x1037a2100, 0x1400045d490}, 0x140001bc608, 0x140003e4ea0}, ...}, ...)
/Users/runner/work/cli/cli/command/v7/curl_command.go:58 +0x1f4
code.cloudfoundry.org/cli/util/command_parser.(*CommandParser).executionWrapper(0x1400004cf50, {0x14ad04880, 0x104024010}, {0x1400011e920, 0x0, 0x2})
Expected behavior
cf curl "/v3/apps/$(cf app myapp --guid)/env" succeeds and prints the app environment.
Exact Steps To Reproduce
% cf create-app myapp
Creating app myapp in org uptime / space test as [email protected]...
Using app type "buildpack"
OK
% cf set-env myapp envvar1 '{{'
Setting env variable envvar1 for app myapp in org uptime / space test as [email protected]...
OK
TIP: Use 'cf restage myapp' to ensure your env variable changes take effect.
% cf set-env myapp envvar1 '{{'
Setting env variable envvar1 for app myapp in org uptime / space test as [email protected]...
OK
TIP: Use 'cf restage myapp' to ensure your env variable changes take effect.
(cf-dev-3.12) D047883@VR9NDXJ7JP myapp % cf curl "/v3/apps/$(cf app myapp --guid)/env"
Something unexpected happened. This is a bug in cf.
Please re-run the command that caused this exception with the environment
variable CF_TRACE set to true.
Also, please update to the latest cli and try the command again:
https://code.cloudfoundry.org/cli/releases
Please create an issue at: https://code.cloudfoundry.org/cli/issues
Include the below information when creating the issue:
Command
cf curl /v3/apps/0052b545-b419-4e5b-a9f5-708531c35f94/env
CLI Version
8.16.0+4b92b73.2025-09-18
Error
template: Display Text:1: bad character U+0022 '"'
Stack Trace
goroutine 1 [running]:
code.cloudfoundry.org/cli/util/panichandler.HandlePanic()
/Users/runner/work/cli/cli/util/panichandler/handler.go:19 +0x48
panic({0x104fda2a0?, 0x140005186f0?})
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/runtime/panic.go:783 +0x120
text/template.Must(...)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/text/template/helper.go:26
code.cloudfoundry.org/cli/util/ui.generateTranslationFunc.func1({0x14000344280, 0x266}, {0x14000518680, 0x1, 0x280?})
/Users/runner/work/cli/cli/util/ui/i18n.go:119 +0x284
code.cloudfoundry.org/cli/util/ui.(*UI).TranslateText(...)
/Users/runner/work/cli/cli/util/ui/ui.go:418
code.cloudfoundry.org/cli/util/ui.(*UI).DisplayText(0x140000d08f0, {0x14000344280, 0x266}, {0x0?, 0x14000051858?, 0x0?})
/Users/runner/work/cli/cli/util/ui/ui.go:248 +0x13c
code.cloudfoundry.org/cli/command/v7.CurlCommand.Execute({{{0x1051ff030, 0x140000d08f0}, {0x105201500, 0x1400032a388}, {0x1051f0588, 0x140003ffe20}, {0x105206100, 0x140003cf490}, 0x140001ac608, 0x14000788000}, ...}, ...)
/Users/runner/work/cli/cli/command/v7/curl_command.go:58 +0x1f4
code.cloudfoundry.org/cli/util/command_parser.(*CommandParser).executionWrapper(0x14000598660, {0x12a938200, 0x105a88010}, {0x140003ffd40, 0x0, 0x2})
/Users/runner/work/cli/cli/util/command_parser/command_parser.go:88 +0x264
github.com/jessevdk/go-flags.(*Parser).ParseArgs(0x140002d43f0, {0x1400003a190, 0x2, 0x2})
/Users/runner/go/pkg/mod/github.com/jessevdk/[email protected]/parser.go:337 +0x818
code.cloudfoundry.org/cli/util/command_parser.(*CommandParser).parse(0x14000598660, {0x1400003a190, 0x2, 0x2}, {0x10500ab20, 0x105a86420})
/Users/runner/work/cli/cli/util/command_parser/command_parser.go:219 +0xbc
code.cloudfoundry.org/cli/util/command_parser.(*CommandParser).ParseCommandFromArgs(...)
/Users/runner/work/cli/cli/util/command_parser/command_parser.go:52
main.main()
/Users/runner/work/cli/cli/main.go:41 +0x1b0
goroutine 51 [IO wait]:
internal/poll.runtime_pollWait(0x105ef7600, 0x72)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/runtime/netpoll.go:351 +0xa0
internal/poll.(*pollDesc).wait(0x14000362b00?, 0x14000400000?, 0x0)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/internal/poll/fd_poll_runtime.go:84 +0x28
internal/poll.(*pollDesc).waitRead(...)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0x14000362b00, {0x14000400000, 0x1800, 0x1800})
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/internal/poll/fd_unix.go:165 +0x1e0
net.(*netFD).Read(0x14000362b00, {0x14000400000?, 0x140007078a8?, 0x10426b5a8?})
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/net/fd_posix.go:68 +0x28
net.(*conn).Read(0x140005a0000, {0x14000400000?, 0x300707918?, 0x12a820aa8?})
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/net/net.go:196 +0x34
crypto/tls.(*atLeastReader).Read(0x14000382060, {0x14000400000?, 0x14000707968?, 0x1044761f4?})
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/crypto/tls/conn.go:816 +0x38
bytes.(*Buffer).ReadFrom(0x1400032a9a8, {0x1051dec60, 0x14000382060})
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/bytes/buffer.go:217 +0x90
crypto/tls.(*Conn).readFromUntil(0x1400032a708, {0x12aa22e00, 0x140005a0000}, 0x14000707a10?)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/crypto/tls/conn.go:838 +0xcc
crypto/tls.(*Conn).readRecordOrCCS(0x1400032a708, 0x0)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/crypto/tls/conn.go:627 +0x340
crypto/tls.(*Conn).readRecord(...)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/crypto/tls/conn.go:589
crypto/tls.(*Conn).Read(0x1400032a708, {0x1400033c000, 0x1000, 0x14000707d28?})
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/crypto/tls/conn.go:1392 +0x14c
net/http.(*persistConn).Read(0x140004dcfc0, {0x1400033c000?, 0x1051daf78?, 0x105a4e800?})
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/net/http/transport.go:2122 +0x48
bufio.(*Reader).fill(0x14000169200)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/bufio/bufio.go:113 +0xe0
bufio.(*Reader).Peek(0x14000169200, 0x1)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/bufio/bufio.go:152 +0x58
net/http.(*persistConn).readLoop(0x140004dcfc0)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/net/http/transport.go:2275 +0x110
created by net/http.(*Transport).dialConn in goroutine 12
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/net/http/transport.go:1944 +0x111c
goroutine 52 [select]:
net/http.(*persistConn).writeLoop(0x140004dcfc0)
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/net/http/transport.go:2597 +0x94
created by net/http.(*Transport).dialConn in goroutine 12
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/net/http/transport.go:1945 +0x1164
goroutine 20 [syscall]:
os/signal.signal_recv()
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/runtime/sigqueue.go:149 +0x2c
os/signal.loop()
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/os/signal/signal_unix.go:23 +0x1c
created by os/signal.Notify.func1.1 in goroutine 1
/Users/runner/hostedtoolcache/go/1.25.0/arm64/src/os/signal/signal.go:152 +0x28
goroutine 21 [chan receive]:
code.cloudfoundry.org/cli/util/configv3.catchSignal(0x0?, {0x1400042e000, 0x27})
/Users/runner/work/cli/cli/util/configv3/write_config.go:63 +0x28
created by code.cloudfoundry.org/cli/util/configv3.(*Config).WriteConfig in goroutine 1
/Users/runner/work/cli/cli/util/configv3/write_config.go:40 +0x1c8
Your Platform Details
e.g. Mac OS X 10.11, Windows 8.1 64-bit, Ubuntu 14.04.3 64-bit
Shell
e.g. Terminal, iTerm, Powershell, Cygwin, gnome-terminal, terminator
%
Provide more context
- platform and shell details: Mac OS , also observed on Windows 11
- version of the CLI you are running: 8.16.0+4b92b73.2025-09-18
- version of the CC API Release you are on: capi-release v1.216.0 (cf api v3 version: 3.201.0)