TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report on Disconnect3d’s blog explains that writing `~` inside a quoted PATH assignment may leave it as a literal character rather than expand it to the home directory. The result can point a command to a relative `./~` directory; using `$HOME` avoids that particular issue.
A warning from the nono agent sandboxing tool prompted developer Disconnect3d to report that a quoted `~/.local/bin/` entry in PATH may not refer to the user’s home directory. In Bash and Zsh, a command can instead search a relative directory literally named `~`, potentially running a different executable than the user intended.
The blog post describes this shell configuration: `export PATH=”$PATH:~/.local/bin/”`. Because the tilde is inside double quotes, it is not expanded to the home directory in this assignment. The PATH value can retain the literal `~/.local/bin/` text, rather than containing a path such as `/home/user/.local/bin/`.
Disconnect3d demonstrated the distinction by creating a program under `./~/.local/bin/` and adding `~/.local/bin/` to PATH. In the example, Bash found and ran that program. The test illustrates that the tilde-named directory was involved; it does not show that the user’s home directory was searched.
The suggested fix is to use `$HOME` explicitly: `export PATH=”$PATH:$HOME/.local/bin/”`. The post says an unquoted form, `export PATH=$PATH:~/.local/bin`, works in Bash and Zsh because those shells perform tilde expansion in relevant assignment positions. Disconnect3d cautions that this form is fragile: whitespace can change how the shell parses the assignment.
How a Literal Tilde Changes Command Lookup
PATH tells a shell where to look for programs when a command is entered. If an entry points to a relative directory named `~` instead of the user’s home directory, the shell may fail to find the intended program there, or may find and run a different file placed in that relative location.
The example matters beyond a cosmetic configuration error because commands are selected from PATH entries. Disconnect3d’s report does not establish that this has caused a security incident, but it shows why users and tools that inspect writable PATH locations may flag unexpected entries. The sandbox warning was the immediate prompt for the post, and the author praised the tool for raising the issue.
Using `$HOME` makes the intended home-directory reference explicit in the quoted assignment. Checking PATH can also reveal entries that still contain a tilde, though the presence of one is a clue to investigate rather than proof of a particular outcome in every shell or setup.
As an affiliate, we earn on qualifying purchases.
The Shell Expansion Behind the Warning
The distinction described in the post comes from tilde expansion rules. Disconnect3d cites Bash documentation stating that an unquoted tilde at the start of a word can expand, and that Bash also checks certain tilde prefixes in variable assignments, including after a colon. Double quotes suppress the relevant expansion in the quoted example.
This is why the author distinguishes between the quoted assignment and `export PATH=$PATH:~/.local/bin`. The latter can expand in Bash and Zsh, but the post advises against relying on it because edits such as introducing whitespace can alter shell parsing. The recommendation is the quoted, explicit form using `$HOME`.
The report offers two checks: `echo “$PATH” | grep — ‘~’` to search the PATH string, or `echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’` to display matching entries. If either command prints a result, users can inspect the relevant `.bashrc`, `.zshrc` or `.profile` and decide whether the entry should use `$HOME`.
““So instead of having /home/
/.local/bin/ added to PATH we end up with ./~/.local/bin/ added to PATH.”” — Disconnect3d, in the October 2 blog post
home directory path configuration tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the PATH Check Can Confirm
The report documents a shell behavior and a reproducible example, but it does not establish how many users have affected configurations or whether the warning has led to any real-world execution or security incident. It also does not claim that every tilde-containing PATH entry behaves identically across all shells and startup configurations.
A matching result from the suggested grep command only shows that a tilde appears in the PATH string. Users still need to inspect the entry and their shell’s behavior to establish what directory is searched. The post specifically discusses Bash and Zsh, and details of the nono warning’s implementation are not provided.
bash zsh shell environment variables
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Check Startup Files and Correct Entries
Disconnect3d advises users to check their PATH for tilde-containing entries, then review the shell startup file that sets them. Where the intention is the user’s home directory, the post recommends replacing the tilde with `$HOME` in the quoted PATH assignment and then checking the resulting PATH value.
The author also said the nono warning could be more verbose and mentioned that a pull request was forthcoming. The post does not provide a status or release date for that proposed change. Until further details are available, the documented checks and explicit `$HOME` form are the practical steps described in the report.
command line path management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does `~` always expand to my home directory in PATH?
No. In the quoted assignment `PATH=”$PATH:~/.local/bin/”`, the tilde may remain literal instead of expanding. The report describes different behavior for an unquoted assignment in Bash and Zsh.
What should I use instead?
For the quoted assignment discussed in the report, use `$HOME`: `export PATH=”$PATH:$HOME/.local/bin/”`.
How can I check for a tilde in PATH?
Run `echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’` to print PATH entries containing a tilde. A result means you should inspect that entry; it does not, by itself, prove which directory your shell searches.
Could the literal entry run an unintended program?
Disconnect3d’s example shows a command being found in `./~/.local/bin/`, a relative directory, rather than the home directory. The post illustrates the possibility but does not report a security incident.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
