On bash 5 the guard allows rm -rf ${X/"/"*/$HOME} and ${X//"/"*/$HOME}, which bash 5.3 prints as the home: readPattern ends a replacement pattern at a quoted /, as bash 3.2 does, while bash 5 keeps a quoted / in the pattern (review-guardSet MAJOR-3). The same reader takes $"" in a pattern for a literal $, so ${X%%$""*}/ reads as not whole and is allowed though every shell prints /.

On bash 5 the guard allows rm -rf ${X/"/"/$HOME} and ${X//"/"/$HOME}, which bash 5.3 prints as the home: readPattern ends a replacement pattern at a quoted /, as bash 3.2 does, while bash 5 keeps a quoted / in the pattern (review-guardSet MAJOR-3). The same reader takes $"" in a pattern for a literal $, so ${X%%$""*}/ reads as not whole and is allowed though every shell prints /.

Grounds

• pursued: ${X/"/"/$HOME} and ${X%%$""}/ block while ${X/[/]*/$HOME} and ./${X/"/"/_} stay allowed; a bash 5 pattern boundary other than a quoted slash that still allows would show it wrong