Correctly parse arguments from environment variables

Cargo.toml

@@ -90,6 +90,7 @@ serde_json = "1.0.120"
 sha1 = "0.10.6"
 sha2 = "0.10.8"
 shell-escape = "0.1.5"
+shlex = "1.3.0"
 similar = "2.6.0"
 supports-hyperlinks = "3.0.0"
 snapbox = { version = "0.6.16", features = ["diff", "dir", "term-svg", "regex", "json"] }
@@ -192,6 +193,7 @@ serde_ignored.workspace = true
 serde_json = { workspace = true, features = ["raw_value"] }
 sha1.workspace = true
 shell-escape.workspace = true
+shlex.workspace = true
 supports-hyperlinks.workspace = true
 tar.workspace = true
 tempfile.workspace = true

src/cargo/util/context/mod.rs

@@ -89,6 +89,7 @@ use lazycell::LazyCell;
 use serde::de::IntoDeserializer as _;
 use serde::Deserialize;
 use serde_untagged::UntaggedEnumVisitor;
+use shlex::Shlex;
 use time::OffsetDateTime;
 use toml_edit::Item;
 use url::Url;
@@ -973,8 +974,8 @@ impl GlobalContext {
             }
         } else {
             output.extend(
-                env_val
-                    .split_whitespace()
+                Shlex::new(env_val)
+                    .into_iter()
                     .map(|s| (s.to_string(), def.clone())),
             );
         }
@@ -2971,9 +2972,13 @@ fn disables_multiplexing_for_bad_curl(
 mod tests {
     use super::disables_multiplexing_for_bad_curl;
     use super::CargoHttpConfig;
+    use super::ConfigKey;
+    use super::Definition;
     use super::GlobalContext;
     use super::Shell;
 
+    use std::collections::HashMap;
+
     #[test]
     fn disables_multiplexing() {
         let mut gctx = GlobalContext::new(Shell::new(), "".into(), "".into());
@@ -3010,4 +3015,37 @@ mod tests {
             assert_eq!(http.multiplexing, result);
         }
     }
+
+    #[test]
+    fn env_argument_parsing() {
+        let mut gctx = GlobalContext::new(Shell::new(), "".into(), "".into());
+        gctx.set_search_stop_path(std::path::PathBuf::new());
+
+        let values: &[(&str, &[&str])] = &[
+            ("VAL1", &["--path"]),
+            ("VAL2", &["--path=\"y z\""]),
+            ("VAL3", &["--path", "\"y z\""]),
+        ];
+
+        let mut env = HashMap::new();
+        for (key, value) in values {
+            env.insert(format!("CARGO_{key}"), value.join(" "));
+        }
+        gctx.set_env(env);
+
+        for (key, value) in values {
+            let mut args = Vec::new();
+            gctx.get_env_list(&ConfigKey::from_str(key), &mut args)
+                .unwrap();
+
+            let mut expected = Vec::new();
+            for sub in *value {
+                expected.push((
+                    sub.replace("\"", ""),
+                    Definition::Environment(format!("CARGO_{key}")),
+                ));
+            }
+            assert_eq!(args, expected, "failed for key {}", key);
+        }
+    }
 }