The shell guard reads a here-document that a command substitution opens and never reads (x=$(cat <<E), a line, then E) as pending after the substitution closes, so the lines after it are the document's body and allow. bash 5 reads them so, but bash 3.2 and /bin/sh, the /bin/bash and /bin/sh of macOS, drop the document at the close and RUN those lines: echo $(( $(echo <<echo) 1 )) followed by echo B, echo and echo C prints 1, B, an empty line and C there. So echo $(cat <<E) x followed by rm -rf ~ and E allows, and heredoc_test.go pins echo $(( $(cat <<EOF) )) followed by git clean -fd and EOF as allow. Present at main 285455056 and at d53e21cf3.

The shell guard reads a here-document that a command substitution opens and never reads (x=$(cat <<E), a line, then E) as pending after the substitution closes, so the lines after it are the document's body and allow. bash 5 reads them so, but bash 3.2 and /bin/sh, the /bin/bash and /bin/sh of macOS, drop the document at the close and RUN those lines: echo $(( $(echo <<echo) 1 )) followed by echo B, echo and echo C prints 1, B, an empty line and C there. So echo $(cat <<E) x followed by rm -rf ~ and E allows, and heredoc_test.go pins echo $(( $(cat <<EOF) )) followed by git clean -fd and EOF as allow. Present at main 285455056 and at d53e21cf3.

Grounds

• pursued: echo $(cat <<E) x, then rm -rf ~, then E, and the $(( $(cat <<EOF) )) form block while the same substitution closed after its body allows; a line of that shape that allows would show it wrong