TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A report published by Disconnect3d on Oct. 2 explains that a quoted tilde in a PATH assignment, such as “$PATH:~/.local/bin”, may not expand to the home directory in Bash or Zsh. The entry can instead refer to a literal directory named “~”; using “$HOME/.local/bin” avoids that ambiguity.
A warning from the nono agent sandboxing tool prompted a report that a quoted tilde in a shell PATH setting may remain literal instead of expanding to a user’s home directory. The report, published by Disconnect3d on Oct. 2, says a setting such as export PATH="$PATH:~/.local/bin/" can make command lookup use a directory named ~ relative to the current location, rather than the user’s ~/.local/bin.
Disconnect3d said nono displayed a warning about a PATH entry it could write to: ~/.local/bin/. The author traced the concern to how tilde expansion works in shell input: Bash expands a leading unquoted tilde in specified contexts, but a tilde inside the quoted value in the example may not be expanded. The resulting PATH entry can therefore retain the tilde character.
The report demonstrates the distinction by creating a program under a literal relative path, ./~/.local/bin/, and then running it with PATH set to "~/.local/bin/". In the example, the command runs from that directory; the home directory is not used. This illustrates that a malformed entry can still locate a command when the corresponding literal directory exists, potentially obscuring the configuration mistake.
The suggested correction is to use the home-directory variable explicitly: export PATH="$PATH:$HOME/.local/bin/". Disconnect3d notes that an unquoted assignment such as export PATH=$PATH:~/.local/bin works in Bash and Zsh under the expansion rules described, but calls that approach fragile: whitespace can change how the shell parses the assignment. The post also suggests checking the current PATH for tildes with echo "$PATH" | grep -- '~', or printing entries on separate lines before searching.
How a PATH Typo Changes Command Lookup
PATH controls where a shell searches when a user runs a command without specifying its full location. If an entry meant to point into the home directory instead contains a literal tilde, commands installed in the intended location may not be found through that entry. A same-named command in a literal tilde directory could be found instead, as the report’s demonstration shows.
The issue matters for people who add local command directories to shell startup files such as .bashrc, .zshrc or .profile. Those files affect later shell sessions, so a mistaken entry can persist until it is corrected. The report describes a configuration pitfall, not evidence of a known compromise or a newly discovered vulnerability; the practical concern is that PATH may resolve commands from an unintended location.
Using $HOME explicitly makes the intended directory apparent and avoids depending on when the shell performs tilde expansion. The author’s quick check can identify PATH values that still contain a tilde, though a match alone does not establish whether every such entry is erroneous.
shell scripting home directory expansion tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Shell Expansion Behind the Warning
In the report, the issue surfaced while Disconnect3d was testing nono, described as an agent sandboxing tool. Its warning identified a PATH location the sandbox could write to. The author then examined a common-looking startup-file assignment that appends a local bin directory using a tilde.
The relevant distinction is whether the tilde is unquoted in a position where the shell recognizes it for expansion. The report cites Bash documentation describing tilde expansion in certain unquoted contexts, including particular variable-assignment cases. It says an unquoted form like PATH=$PATH:~/.local/bin works in both Bash and Zsh, while the quoted form shown in the warning scenario may preserve the tilde. The report recommends $HOME as the clearer, less fragile form.
Disconnect3d credited nono with flagging the entry, while saying the warning could explain the issue in more detail. The author wrote that a pull request was forthcoming; the post does not establish whether that change was later submitted or merged.
“PATH entries the sandbox can write to: ~/.local/bin/”
— Disconnect3d, in the report
bash zsh configuration debugging tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Report Does Not Establish
The report demonstrates the behavior in its example, but does not say how many users or shell configurations are affected. It also does not establish that every PATH entry containing ~ is a mistake: the correct interpretation depends on how the value was created and what directory is intended.
The source discusses Bash and Zsh and does not provide a survey across other shells, versions or startup-file conventions. Nor does it report a security incident arising from the configuration. The nono warning indicates a writable PATH entry in the described setup; by itself, that does not show that an attacker wrote to the directory or that a user’s system was compromised.
As an affiliate, we earn on qualifying purchases.
Check Startup Files and the Tool Warning
Users who want to check their current environment can search PATH for a tilde or print each colon-separated entry on its own line, as the report suggests. If an entry was intended to refer to the home directory, the author recommends replacing the tilde with $HOME in the relevant shell startup file, then opening a new shell and checking the resulting PATH.
Disconnect3d said a pull request was incoming to make nono’s warning more informative, but the report gives no later status. Whether that change was submitted or adopted remains unknown from the available source.
command line environment setup tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does a tilde in PATH always mean there is a problem?
No. A tilde in PATH is a reason to inspect the entry, not proof it is wrong. The report’s concern is a quoted tilde that was intended to expand to the home directory but remains literal.
What should I use instead of a tilde?
For the example in the report, use $HOME, as in export PATH="$PATH:$HOME/.local/bin/". The author says this avoids relying on tilde expansion in a quoted value.
How can I check whether my PATH contains a tilde?
The report suggests running echo "$PATH" | grep -- '~'. To inspect entries separately, use echo "$PATH" | tr ':' '\n' | grep '~'.
Does this mean my computer has been compromised?
No such compromise is reported. The post describes a shell configuration issue and a sandbox warning about a writable PATH location; it does not say that an attacker used the entry.
Which shells does the report discuss?
Disconnect3d discusses Bash and Zsh. The post does not test or make claims about every shell or every configuration.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
