-
-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Closed
Labels
Milestone
Description
The command string escape allows bypassing limitations of the scripting language where needed, e.g. to store a list in a single string (allowing, but discouraging, nested list semantics) with
set var (printf "%s " (string escape $PATH))
As of 2.4.0, however, there is no safe way to unescape such values. While
set list_var (eval "printf '%s\n' $var")
unpacks the quoted list into an actual list, but will happily evaluate any commands smuggled into a manipulated $var as well. A string unescape subcommand would fix this.
- Have you checked if problem occurs with fish 2.4.0?
- Tried fish without third-party customizations (check
sh -c 'env HOME=$(mktemp -d) fish')?
fish version installed (fish --version): 2.4.0-111-g7356987
OS/terminal used: Windows 10, Mintty
Reactions are currently unavailable