Reject null characters in process environment variable names

src/libraries/System.Diagnostics.Process/src/Resources/Strings.resx

@@ -318,6 +318,9 @@
   <data name="Argument_EncodingConversionOverflowChars" xml:space="preserve">
     <value>The output char buffer is too small to contain the decoded characters, encoding '{0}' fallback '{1}'.</value>
   </data>
+  <data name="Argument_NullCharInEnvVar" xml:space="preserve">
+    <value>Environment variable cannot contain a null character.</value>
+  </data>
   <data name="ArgumentOutOfRange_GetByteCountOverflow" xml:space="preserve">
     <value>Too many characters. The resulting number of bytes is larger than what can be returned as an int.</value>
   </data>

src/libraries/System.Diagnostics.Process/src/System/Collections/Specialized/DictionaryWrapper.cs

@@ -17,7 +17,13 @@ public DictionaryWrapper(Dictionary<string, string?> contents)
         public string? this[string key]
         {
             get => _contents[key];
-            set => _contents[key] = value;
+            set
+            {
+                Validate(nameof(key), key);
+                Validate(nameof(value), value);
+
+                _contents[key] = value;
+            }
         }
 
         public object? this[object key]
@@ -81,5 +87,14 @@ public bool Remove(KeyValuePair<string, string?> item)
         public IEnumerator<KeyValuePair<string, string?>> GetEnumerator() => _contents.GetEnumerator();
         IEnumerator IEnumerable.GetEnumerator() => _contents.GetEnumerator();
         IDictionaryEnumerator IDictionary.GetEnumerator() => _contents.GetEnumerator();
+
+        private static void Validate(string name, string? value)
+        {
+            if (value is not null && value.Contains('\0'))
+            {
+                throw new ArgumentException(SR.Argument_NullCharInEnvVar, name);
+            }
+        }
+
     }
 }

src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessUtils.Windows.cs

@@ -110,6 +110,7 @@ internal static string GetEnvironmentVariablesBlock(DictionaryWrapper sd)
                 // Ignore null values for consistency with Environment.SetEnvironmentVariable
                 if (value != null)
                 {
+                    // DictionaryWrapper prevents user-supplied keys and values from containing null characters.
                     result.Append(key).Append('=').Append(value).Append('\0');
                 }
             }

src/libraries/System.Diagnostics.Process/tests/ProcessStartInfoTests.cs

@@ -210,6 +210,28 @@ public void TestEnvironmentProperty()
             });
         }
 
+        [Fact]
+        public void EnvironmentVariableContainingNull_ThrowsArgumentException()
+        {
+            const string InvalidKey = "Name\0Suffix";
+            const string InvalidValue = "Value\0Suffix";
+            ProcessStartInfo psi = new ProcessStartInfo();
+            IDictionary environment = (IDictionary)psi.Environment;
+            ICollection<KeyValuePair<string, string>> environmentCollection = psi.Environment;
+
+            AssertExtensions.Throws<ArgumentException>("key", () => psi.Environment[InvalidKey] = "value");
+            AssertExtensions.Throws<ArgumentException>("key", () => environment[InvalidKey] = "value");
+            AssertExtensions.Throws<ArgumentException>("key", () => psi.Environment.Add(InvalidKey, "value"));
+            AssertExtensions.Throws<ArgumentException>("key", () => environmentCollection.Add(new KeyValuePair<string, string>(InvalidKey, "value")));
+            AssertExtensions.Throws<ArgumentException>("key", () => environment.Add(InvalidKey, "value"));
+
+            AssertExtensions.Throws<ArgumentException>("value", () => psi.Environment["key"] = InvalidValue);
+            AssertExtensions.Throws<ArgumentException>("value", () => environment["key"] = InvalidValue);
+            AssertExtensions.Throws<ArgumentException>("value", () => psi.Environment.Add("key", InvalidValue));
+            AssertExtensions.Throws<ArgumentException>("value", () => environmentCollection.Add(new KeyValuePair<string, string>("key", InvalidValue)));
+            AssertExtensions.Throws<ArgumentException>("value", () => environment.Add("key", InvalidValue));
+        }
+
         [ConditionalFact(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
         public void TestSetEnvironmentOnChildProcess()
         {