On 2026-09-04 16:57, Artyom Bologov wrote:
|| On 2026-09-04 14:35, Antonio Diaz wrote:
|| POSIX says the same[1]
|
| Yeah, we seem to be reading the same text from different sources, ahah.
Antonio, you delete my open source manual and distribute POSIX, a
Copyrighted work, verbatim under GNU Copyleft. Please cease and
desist. I think my manual is clearer than POSIX anyhow:
!command
Executes command via sh(1). If the first character of command
is ‘!’, then it is replaced by text of the previous !command.
The ed utility does not process command for backslash (\)
escapes. However, an unescaped % is replaced by the default
filename. When the shell returns from execution, ‘!’ is
printed to the standard output. The current line is unchanged.
| Here’s a CVE scenario for you:
|
| $ ed "hello\"there"
| hello"there: No such file or directory
| !echo %
| echo hello"there
| sh: 1: Syntax error: Unterminated quoted string
|
| Shall we call it “ed(1) injection?”
It would only be a CVE if the shell was invoked with escalated
privileges. Any program that provides shell access is dangerous or
powerful, depending on your point of view. To protect against
self-inflicted harm, one has the option of running ed in restricted
mode. This is usually done by invoking it as red.
Lumin Etherlight clearly states the problem of attempting to quote
shell special character in his post. That's why no version of vi (that
I'm aware of) has attempted this either. In shell scripts, it's
imperative to quote user input. But that's on you, not ed.
| H
| !# Get current file name
| r !echo '%'
| p
| Q
FYI, you can omit the ! from `!# Get current file name'. ed treats
lines beginning with `#' as comments. Regards.
