cmd/go/internal/script: add fuzz test for quoteArgs

Adds a fuzz test for quoteArgs and fixes the bugs it found:
handling of empty strings and strings containing "&" or "$".

This is a copy of a similar change submitted to rsc.io/script:
https://github.com/rsc/script/pull/10

Change-Id: I76e7fc89475e1c4e415f45f2c7ac4a87a7a659e6
Reviewed-on: https://go-review.googlesource.com/c/go/+/566316
Reviewed-by: Michael Matloob <matloob@golang.org>
Reviewed-by: Michael Matloob <matloob@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>

1 files changed, 35 insertions, 0 deletions

diff --git a/src/cmd/internal/script/engine_test.go b/src/cmd/internal/script/engine_test.go
new file mode 100644
index 0000000000..45d0a0faf9
--- /dev/null
+++ b/src/cmd/internal/script/engine_test.go
@@ -0,0 +1,35 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package script
+
+import (
+	"context"
+	"slices"
+	"testing"
+)
+
+func FuzzQuoteArgs(f *testing.F) {
+	state, err := NewState(context.Background(), f.TempDir(), nil /* env */)
+	if err != nil {
+		f.Fatalf("failed to create state: %v", err)
+	}
+
+	f.Add("foo")
+	f.Add(`"foo"`)
+	f.Add(`'foo'`)
+	f.Fuzz(func(t *testing.T, s string) {
+		give := []string{s}
+		quoted := quoteArgs(give)
+		cmd, err := parse("file.txt", 42, "cmd "+quoted)
+		if err != nil {
+			t.Fatalf("quoteArgs(%q) = %q cannot be parsed: %v", give, quoted, err)
+		}
+		args := expandArgs(state, cmd.rawArgs, nil /* regexpArgs */)
+
+		if !slices.Equal(give, args) {
+			t.Fatalf("quoteArgs failed to round-trip.\ninput:\n\t%#q\nquoted:\n\t%q\nparsed:\n\t%#q", give, quoted, args)
+		}
+	})
+}