search

cantino / mcfly

Fly through your shell history. Great Scott!
MIT License
6.89k stars 178 forks source link

Command line values are incorrectly parsed for substitutions #176

Closed CreativeCactus closed 3 years ago

CreativeCactus commented 3 years ago

Unexpected environment variable substitutions occur on escaped history lines when pressing enter after the previous command included an escaped substitution-like string.

image

I mixed up my quotes and ended up with a file like the above. I can move or delete it without any issues, but McFly prints an error which suggests it is trying to perform substitution on the input, despite it being escaped.

This is an obscure issue, but I figured it might highlight other potential issues with the way history lines are handled, and might present a privilege escalation risk.

cantino commented 3 years ago

Thanks, I agree this is a bug!