search

tadzik / rakudobrew

Perl 6 installation manager
MIT License
185 stars 42 forks source link

rakudobrew init ... opens ./ attack #147

Closed rehsack closed 5 years ago

rehsack commented 5 years ago

rakudobrew recommends

# This can be easily done using:

echo 'eval "$(/Users/sno/.rakudobrew/bin/rakudobrew init <Bash|Sh|Zsh|Fish>)"' >> ~/.profile

But the command creates evil code:

$ PATH=$PATH:~/.rakudobrew/bin rakudobrew init Bash
export PATH="/Users/sno/.rakudobrew/bin:/Users/sno/perl5/perlbrew/bin:/Users/sno/rakudo/bin:/Users/sno/bin:/opt/pkg/bin:/opt/pkg/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/MacGPG2/bin:/Applications/MacVim.app/Contents/bin:/opt/X11/bin:/Applications/Wireshark.app/Contents/MacOS:"

The final ":" in the PATH let the shell search in "." for executables, which is extremely dangerous.