TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published by Disconnect3d on Oct. 2 explains that quoting a tilde in a PATH assignment can prevent Bash and Zsh from expanding it to the home directory. The recommended fix is to use $HOME, and users can search their PATH for entries that still contain a tilde.
A shell configuration mistake can leave a literal ~ in a user’s PATH instead of pointing to their home directory, according to a report published Oct. 2 by Disconnect3d. The post recommends writing $HOME/.local/bin in quoted PATH assignments, because a tilde inside quotes is not expanded in the example described.
The author said the issue came to attention after the nono agent sandboxing tool warned that a PATH entry it could write to was ~/.local/bin/. The problematic example was export PATH="$PATH:~/.local/bin/", a form that puts the tilde inside double quotes. In the author’s test, the entry remained literal rather than becoming a path such as /home/<user>/.local/bin/.
The post demonstrated that a literal tilde can refer to an ordinary directory named ./~ relative to the current working directory. The author created a program under ./~/.local/bin/, set PATH to ~/.local/bin/, and ran the program by name. In that test, the shell found and executed the program from the directory named ~; the user’s home directory was not involved.
The suggested replacement is export PATH="$PATH:$HOME/.local/bin/". The author also noted that an unquoted assignment, export PATH=$PATH:~/.local/bin, works in Bash and Zsh in the described case because those shells perform tilde expansion in certain assignment positions. The post cautions against relying on that form, saying whitespace can break the assignment.
How a Literal Tilde Changes PATH
PATH tells a shell where to search for executable programs when a user types a command. If an entry intended to point to a home-directory tool folder is instead interpreted as a relative path containing a literal tilde, the shell may search a different location. The author’s demonstration shows that a command can still run successfully from that unintended location, which can make the configuration error less obvious.
The sandbox warning is relevant because software that can write into a directory on PATH may affect which executable is found when a command is run. The source does not report a compromise or claim that every quoted tilde creates a security issue. It describes a configuration pitfall and a warning from a specific tool; the practical risk depends on the directories present, how PATH is set, and the programs a user runs.
For users who add local command-line tools to their shell setup, replacing the tilde with $HOME makes the intended home-directory path explicit in the quoted example. It can also help avoid confusion when troubleshooting why a tool is or is not found.
As an affiliate, we earn on qualifying purchases.
The Shell Expansion Rule Behind It
The report concerns tilde expansion, a shell feature that turns an unquoted tilde in certain positions into a home-directory path. Disconnect3d cites Bash documentation describing expansion for an unquoted tilde-prefix at the start of a word, as well as in some variable assignments after an equals sign or colon. The placement and quoting matter: the example in the post places the tilde inside a quoted string.
The author says the unquoted assignment works in both Bash and Zsh for the illustrated PATH pattern, while recommending $HOME as the more reliable choice. The post’s advice is narrowly about shell startup files such as .bashrc, .zshrc, or .profile and entries added to PATH; it is not a claim that tilde expansion behaves identically in every shell or command context.
“Instead of /home/
/.local/bin/ added to PATH we end up with ./.~/.local/bin/ added to PATH.” — Disconnect3d, in the blog report
As an affiliate, we earn on qualifying purchases.
What the Report Does Not Establish
The post is a single author’s report and demonstration, not a survey of shell configurations or a security incident report. It does not establish how common the mistake is, how many users are affected, or whether any systems were harmed. The example focuses on Bash and Zsh; the report does not provide equivalent tests for every shell or every way PATH can be assigned.
The author says a contribution to make nono’s warning more verbose was forthcoming, but the source does not confirm whether that change was submitted, accepted, or released. It also does not specify the exact behavior of every shell startup file or environment-management tool a reader may use.
As an affiliate, we earn on qualifying purchases.
Check and Correct PATH Entries
The author suggests checking the current PATH with echo "$PATH" | grep -- '~'. To inspect individual entries, the post gives echo "$PATH" | tr ':' '\n' | grep '~'. If a tilde-containing entry appears, users can review the shell startup file or profile that sets it and replace the quoted tilde with $HOME, then start a new shell and check the resulting PATH.
Disconnect3d also said a change to make nono’s warning more explanatory was planned. The report does not give a release date or confirm that the proposed change has shipped, so users should treat that improvement as pending unless the tool’s own release information says otherwise.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the recommended PATH syntax?
For the example in the report, use export PATH="$PATH:$HOME/.local/bin/". The author recommends $HOME rather than a quoted tilde.
Why can a quoted tilde cause a problem?
In the reported assignment, the tilde is inside quotes, so it can remain a literal character rather than expanding to the home directory. PATH may then refer to a directory named ~ relative to the current directory.
How can I check whether my PATH contains a tilde?
Run echo "$PATH" | tr ':' '\n' | grep '~' to print entries containing a tilde, one entry per line. The report advises reviewing any such result in the relevant shell configuration.
Does the report say that every tilde in PATH is unsafe?
No. It describes a specific quoting pitfall and a demonstration, not a universal security finding. The effect depends on how PATH was assigned and what directories and executables are present.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
