GothenburgBitFactory / GothenburgBitFactory/taskwarrior
environment variable expansion in rcfile has no escape mechanism
- Dominant language
- C++
- Stars
- 6.1k
- Forks
- 423
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 11
Description
The new use of `Path::expand()` on rcfile in 2.6.0 is trying to expand anything that looks like `\$[[:alnum:]_]+` anywhere in the value string (except I guess if it's alone or at end), hopefully nobody has rcfile like this:
```
uda.profit.type = numeric
uda.loss.type = numeric
report.pnl.columns = profit,loss
report.pnl.labels = $PROFIT,$LOSS
```
Just a contrived example, but maybe we should have some way to allow escape of `$`, like `\$` or `$$`. (Even this would be a problem if some values were, eg things that got passed to `system(3)`, but don't think there's anything like that today).
It might be fine to just keep it as "you can't use $ in taskrc values" (except as environment variables), if this never actually comes up. The only other thing I can think of is to have an internal flag for rc values that would be subject to `Path::expand()` and make them more limited.
Contributor guide
Assessment
This issue has not been assessed yet.