#767655 bash: Quoted tilde expands in parameter substitution

Package:
bash
Source:
bash
Description:
GNU Bourne Again SHell
Submitter:
Alois Mahdal
Date:
2014-11-01 17:39:06 UTC
Severity:
normal
#767655#5
Date:
2014-11-01 17:37:38 UTC
From:
To:
On Jessie, calling `echo "${FOO/bar/~}"` now always expands the tilde to
`$HOME`.  On Wheezy (4.2+dfsg-0.1+deb7u3) the tilde is not expanded, as
well as on latest Fedora and RHEL7 (can't say the exact versions now).

Following code can be used as reproducer:

    FOO=bar
    echo "${FOO/a/~}" | grep \~

Above construct should replace `a` with `~` and print `b~r`, but
instead it replaces `a` with whatever contents of your HOME variable
are.


Further notes
-------------

Bash is not particularly clear about this in the manpage:

I mean, is the tilde considered quoted, since it's in a quoted
argument, or unquoted since it's not quoted as of itself.

Quoting the tilde itself, i.e. `echo "${FOO/a/"~"}"` does bring desiired
behavior but fails on other mentioned versions--here `b"a"r` is printed.
(Same holds for backslash quoting).

Omitting the outer quotes from the expression *and* quoting the tilde by
itself

    echo ${FOO/a/"~"}

seems to print `b~r` everywhere, although it's dangerous workaround from
security POV.