I am puzzled by it for quite some while now. In $PROMPT_COMMAND of the bash in OS X, there is a command called update_terminal_cwd. I am sure it's not a bash built in, and most likely only exists in OS X. But I don't know what exactly it does. Anyone knows?


It updates the prompt to echo the Current Working Directory (CWD) and is defined in /etc/bashrc:

update_terminal_cwd() {
    # Identify the directory using a "file:" scheme URL,
    # including the host name to disambiguate local vs.
    # remote connections. Percent-escape spaces.
    local SEARCH=' '
    local REPLACE='%20'
    local PWD_URL="file://$HOSTNAME${PWD//$SEARCH/$REPLACE}"
    printf '\e]7;%s\a' "$PWD_URL"
  • It might be worth noting that the function is only defined if you're running your shell in the Apple Terminal app. If you're using iTerm, it won't be defined.
    – nwinkler
    Jun 25 '15 at 9:22
  • What the heck is the escape-7 for and where does it print to? Where is that documented? :)
    – Wildcard
    Dec 23 '15 at 4:08
  • 1
    @Wildcard It's an xterm control code to set the title bar text. The most accessible documentation is perhaps the Linux Bash Prompt Howto. There is real documentation in the xterm sources, IIRC.
    – tripleee
    Jul 7 '16 at 19:32
  • 2
    This function is set in line 9 of /etc/bashrc_Apple_Terminal (found via a trick learned here). But I find that inside a screen session, $PROMPT_COMMAND becomes an empty string, which means /etc/bashrc_Apple_Terminal is probably not executed anymore. Do you know why?
    – zyxue
    Jan 11 '17 at 18:24
  • 1
    @zyxue if you look at /etc/bashrc, it uses the variable $TERM_PROGRAM to determine the terminal and run a corresponding /etc/bashrc_$TERM_PROGRAM if it exists. So in the screen session, $TERM_PROGRAM probably isn't set, or is set to something other than Apple_Terminal. Jul 10 '18 at 21:51

Opaque secret encoded format string, '\e]7;%s\a'. Suspect.


From what I gather, "file://$HOSTNAME" is masked out so you can't see remote protocol:host espionage.

  • 1
    ...or $HOSTNAME is a variable that changes depending on the system the script is running on. ?!? Paranoid much? If you think the code listed in the other answer can do anything other than print to the screen, you have no idea how bash scripting works.
    – tubedogg
    Nov 24 '14 at 5:20
  • Didn't you get the memo ? - "ShellShock" bash vulnerability web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271 In any case 1) Unknown origin in that I didn't set that environment variable 'update_terminal_cwd' 2) On top of that, it's a function. Automatically suspect. Mass infiltration. Nobody wants that. Maybe NIST will report Apple OSX and browser Firefox/Chrome/Opera "vulnerabilities" ?
    – user982671
    Nov 29 '14 at 13:40
  • 7
    You continue to demonstrate you have no idea what you are talking about. update_terminal_cwd is not an environment variable, it is the name of a function. It is defined in clear text in /etc/bashrc and the printf function does not have the ability to do anything except print formatted strings to the screen. Finally, the vuln link you posted involves executing arbitrary functions by appending text to an environment variable definition...which has nothing to do with anything that is being discussed here. And wtf do browsers have to do with shell scripting?
    – tubedogg
    Nov 30 '14 at 0:02
  • This does not attempt to answer the question that was asked (see here for detailed analysis to justify this statement). Please reserve the answer box for answers that answer the question that was asked. Thank you!
    – D.W.
    Jul 3 '15 at 1:43
  • 1
    @tubedogg haha yeah, if you just do a typeset -f it will show all the "user defined" functions and that's how this popped up. If they were trying to do something sketchy, they wouldn't make this easily visible. Nov 26 '16 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .