Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You can fool it with ^H (Insert with ^V^H in vim)

  #!/bin/sh
  rm not ^H^H^H^H expected
Gives:

  -> rm  expected
  Run command? [Y/n] 
  rm: cannot remove 'not': No such file or directory
  rm: cannot remove ''$'\b\b\b\b': No such file or directory
  rm: cannot remove 'expected': No such file or directory


I updated to fix that, thanks for pointing it out. It had to do with echo printing the command with your backspace characters escaped. See if you can break it now, it's interesting how many weird cases exist in tty's.


Heredocs are a little odd, because you can't see what they might be piping to.

This script, for example looks sort of innocuous when run through your tool because it's not obvious the HEREDOC is going to the stdin of a Perl interpreter. Your tool shows them like they are two separate things that don't do much by themselves.

Looking at the script itself, it's more obvious.

  #!/bin/sh
  cat<<'EOF'|perl -nE'BEGIN{shift(@ARGV)}s#(.*)#$1#ee' /dev/null
  say "hello"; #arbitrary perl code
  EOF
That's probably a nit, really, though. I don't know that anyone would target it on purpose.


Yup, at that point it's within the scope of bash's debugger. It shows the command that is actually being run, so it expands globs, shows the command within if predicates, and so on. If bash shows a command that isn't actually about to run, that is a bash bug.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: