This removes the environment variable parsing code from the SSH server,
which never worked in the first place. Since environment variable
passing doesn't appear to be necessary for the built-in SSH server to
work properly, it's removed to reduce attack surface rather than fixing
it.
The current code processes (untrusted) input in a buggy manner and
passes it to a process invocation which doesn't actually do anything. I
don't *think* this is an exploitable vulnerability but I haven't looked
at it in detail, and it wouldn't really surprise me if it was.
Closes#1935, an alternative proposal which which partially fixes the
environment variable handling but ultimately still leaves it broken.
Signed-off-by: Hugo Landau <hlandau@devever.net>
4a6466cca5