POSIX wordexp(3) is dangerous

POSIX wordexp(3) is a C API used for shell-style expansions, such as tilde expansion (e.g., converting "~/foo" to "/home/me/foo"). However, this function can be dangerous when handling untrusted inputs. By default, wordexp(3) enables all expansion features, including command expansion, which can lead to security vulnerabilities.

Disabling command expansion requires passing the WRDE_NOCMD flag. Unfortunately, this workaround may not be effective in all libc implementations. For instance, musl and macOS libc rely on the system shell for wordexp(3) processing, which can result in unexpected behavior. In the case of musl, the issue was still present as late as 2023, while macOS defaulted to zsh instead of bash.

Therefore, it is strongly advised against using wordexp(3) on untrusted inputs, even when employing the WRDE_NOCMD flag. Prior to macOS's shift to zsh, wordexp(3) would delegate to Perl, but the current solution appears to be the wordexp-helper function.