...
This rule is a more specific instance of STR02-AC. Sanitize data passed to complex subsystems.
C99 states that, "the set of environment names and the method for altering the environment list are implementation-defined." It is therefore important to understand what local functions are available for clearing, modifying, and looking up default values for environment variables. Because some programs may behave in unexpected ways when certain environment variables are not set, it is important to understand which variables are necessary on your system and what are safe values for them.
...