An unquoted heredoc halved my backslashes and turned a character class into the letter w
Same characters typed into two heredocs. The only difference is a pair of quotes around the delimiter. $ cat > unquoted.js << EOF const re = new RegExp("Desktop\\/(\\w+)"); console.log(String(re)); EOF $ cat > quoted.js << ' EOF ' const re = new RegExp("Desktop\\/(\\w+)"); console.log(String(re)); EOF $ diff unquoted.js quoted.js 1c1 < const re = new RegExp("Desktop\/(\w+)"); --- > const re = new…
Two heredocs with identical content, except for the presence or absence of quotes around the delimiter, demonstrated different behaviors when processed by a script. The unquoted heredoc consumed backslashes, altering the regular expression pattern and causing it to match literal characters instead of word characters. This led to incorrect paths being generated and stored in files, potentially causing issues for other tools that relied on those paths.
The second, quoted heredoc passed through without modification, preserving the original pattern and allowing it to function as intended. The issue arose from the script's unsafe handling of backslashes and backticks, which were expanded and executed before the intended reader could process them. The reporter learned the hard way that any code containing a backslash or backtick should be placed in a separate file and executed directly, rather than being embedded in a shell string.
This mistake was made twice within a day, highlighting the importance of following established best practices and thoroughly reviewing changes before committing them.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
