Repository: cantino/mcfly (language: rust)

Issue:
Command line values are incorrectly parsed for substitutions
Unexpected environment variable substitutions occur on escaped history lines when pressing enter after the previous command included an escaped substitution-like string.

![image](https://user-images.githubusercontent.com/12624092/126738366-43d57558-4035-42b2-b582-95af82ff4924.png)

I mixed up my quotes and ended up with a file like the above. I can move or delete it without any issues, but McFly prints an error which suggests it is trying to perform substitution on the input, despite it being escaped.

This is an obscure issue, but I figured it might highlight other potential issues with the way history lines are handled, and might present a privilege escalation risk.


Discussion / hints:
Thanks, I agree this is a bug!

Fix patch:
diff --git a/src/path_update_helpers.rs b/src/path_update_helpers.rs
index 4efe1619..8e441b7c 100644
--- a/src/path_update_helpers.rs
+++ b/src/path_update_helpers.rs
@@ -4,8 +4,7 @@ use std::path::Path;
 use unicode_segmentation::UnicodeSegmentation;
 
 pub fn normalize_path(incoming_path: &str) -> String {
-    let expanded_path = shellexpand::full(incoming_path)
-        .unwrap_or_else(|err| panic!("McFly error: Unable to expand command path ({})", err));
+    let expanded_path = shellexpand::tilde(incoming_path);
 
     let current_dir = env::var("PWD").unwrap_or_else(|err| {
         panic!(


Test patch: