The tilde in your PATH may not be your HOME

A recent issue surfaced while testing the nono agent sandboxing tool, which alerted users to a potential problem with their PATH environment variable. Specifically, the sandbox detected entries in PATH that could be written to, such as ~/.local/bin/. The warning suggested that simply adding ~ (tilde) to the PATH could lead to unexpected behavior, as the tilde expansion only occurs in unquoted inputs.

According to the bash documentation, tilde-prefixes, which begin with an unquoted tilde character (~), are expanded only when followed by the first unquoted slash (/) or the first equals sign (=). This means that if a user includes ~ in their PATH, it will expand to the current user's home directory only if the tilde is not enclosed within quotes.

In the example given, instead of adding /home/user/.local/bin/ to PATH, the sandbox encountered ./~/.local/bin/ added to PATH. This discrepancy occurred because the tilde expansion was performed in the variable assignment after the equals sign (=) or after each colon (:). However, relying on this behavior is considered fragile, as it can be broken by whitespace or other factors.

To check for this issue, users can run a simple command that prints the PATH, replacing all instances of ~ with $HOME. If the command outputs anything, it indicates that the PATH should be updated with the correct $HOME notation. The nono tool provided a valuable warning about this potential issue, although it could benefit from more detailed explanations in the future.