{
  "id": 5803874,
  "title": "An unquoted heredoc halved my backslashes and turned a character class into the letter w",
  "url": "https://urgent.news/2026/09/05/an-unquoted-heredoc-halved-my-backslashes-and-turned-a-character",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-05T17:24:35.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mahirhir/an-unquoted-heredoc-halved-my-backslashes-and-turned-a-character-class-into-the-letter-w-2k96"
  },
  "original_language": "en",
  "account": "Two heredocs with identical content, except for the presence or absence of quotes around the delimiter, demonstrated different behaviors when processed by a script. The unquoted heredoc consumed backslashes, altering the regular expression pattern and causing it to match literal characters instead of word characters. This led to incorrect paths being generated and stored in files, potentially causing issues for other tools that relied on those paths. The second, quoted heredoc passed through without modification, preserving the original pattern and allowing it to function as intended. The issue arose from the script's unsafe handling of backslashes and backticks, which were expanded and executed before the intended reader could process them. The reporter learned the hard way that any code containing a backslash or backtick should be placed in a separate file and executed directly, rather than being embedded in a shell string. This mistake was made twice within a day, highlighting the importance of following established best practices and thoroughly reviewing changes before committing them.",
  "summary": "Same characters typed into two heredocs. The only difference is a pair of quotes around the delimiter. $ cat > unquoted.js << EOF const re = new RegExp(\"Desktop\\\\/(\\\\w+)\"); console.log(String(re)); EOF $ cat > quoted.js << ' EOF ' const re = new RegExp(\"Desktop\\\\/(\\\\w+)\"); console.log(String(re)); EOF $ diff unquoted.js quoted.js 1c1 < const re = new RegExp(\"Desktop\\/(\\w+)\"); --- > const re = new…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}