Hacker News Reader

Comment by ComputerGuru | Hacker News Reader

On the other hand, fish being a clean-room shell implementation not beholden to the baggage of legacy systems is immune to some crazy behaviors or vulnerabilities that other shells - including zsh - are prone to: https://yossarian.net/til/post/some-surprising-code-executio...

Compatibility has also come a long way in recent releases; you should give it a try.

View on HN

They don't work in zsh; they're bash issues.

No, they work in zsh, with one extremely small change: The referenced variable needs to exist.

Try this (tested with zsh 5.9 on archlinux):

    foo='PWD[$(echo hahaha >&2)0]+42'
    [[ "$foo" -eq 5 ]]

In bash, this would also print "hahaha" with "a" (or any other possible variable name) instead of "PWD", that's why many think it doesn't work at all in zsh.

I'm pretty sure zsh has an optimization where it skips the indexing if the variable doesn't exist, which happens to sometimes stop this. But since you can just reference variables like PWD, that you know exist, it's not really a security improvement.

I don't have a system capable of building rust applications so no thank you

Reply on news.ycombinator.com