René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"REDIRECTION_TOKENS mutated by alias/macro create+list (4 locations) -- compounding cross-instance state corruption","articleBody":"Hi cmd2 team — found a module-level state mutation bug in `cmd2/cmd2.py` while running adversarial test generation via [tailtest](https://tailtest.com). One root cause, four copy-pasted source locations, compounding effect across calls.\n\n### Bug\n\nFour functions assign `constants.REDIRECTION_TOKENS` by reference then `.extend()` it with terminators:\n\n| Function | Line |\n|---|---|\n| `_alias_create` | 3821 |\n| `_alias_list` | 3901 |\n| `_macro_create` | 4068 |\n| `_macro_list` | 4191 |\n\nEach is shaped like:\n\n```python\ntokens_to_unquote = constants.REDIRECTION_TOKENS  # reference, not copy\ntokens_to_unquote.extend(self.statement_parser.terminators)\n```\n\nEvery call to these four functions permanently appends terminators to the module-level `constants.REDIRECTION_TOKENS`. Over multiple calls the list grows without bound:\n\n```\nAfter 0 calls: ['|', '\u003e', '\u003e\u003e']\nAfter 1 call:  ['|', '\u003e', '\u003e\u003e', ';']\nAfter 5 calls: ['|', '\u003e', '\u003e\u003e', ';', ';', ';', ';', ';', ';', ';', ';']\n```\n\n### Impact\n\n1. **Compounding mutation:** Each alias/macro create/list call pollutes the global list.\n2. **Cross-instance corruption:** Two `Cmd()` instances in the same process share the corrupted state. Instance A's alias operations affect instance B's redirection parsing.\n3. **Unbounded growth in long-running sessions:** Each invocation adds duplicates.\n\n### Fix\n\nIn all 4 locations, change:\n\n```python\ntokens_to_unquote = constants.REDIRECTION_TOKENS\n```\n\nto:\n\n```python\ntokens_to_unquote = list(constants.REDIRECTION_TOKENS)\n```\n\n### Reproduction\n\n```python\nimport pytest\nfrom cmd2 import Cmd\nfrom cmd2 import constants\n\n\ndef test_alias_create_does_not_mutate_redirection_tokens():\n    \"\"\"alias create should not mutate the module-level REDIRECTION_TOKENS list.\"\"\"\n    snapshot = list(constants.REDIRECTION_TOKENS)\n    app = Cmd()\n    app.onecmd_plus_hooks(\"alias create myalias echo hello\")\n    assert constants.REDIRECTION_TOKENS == snapshot, (\n        f\"BUG: REDIRECTION_TOKENS mutated by alias create. \"\n        f\"Was {snapshot!r}, now {constants.REDIRECTION_TOKENS!r}\"\n    )\n\n\ndef test_repeated_alias_creates_compound_mutation():\n    \"\"\"Compound effect: 5 alias creates should not grow REDIRECTION_TOKENS.\"\"\"\n    snapshot = list(constants.REDIRECTION_TOKENS)\n    app = Cmd()\n    for i in range(5):\n        app.onecmd_plus_hooks(f\"alias create alias_{i} echo {i}\")\n    assert constants.REDIRECTION_TOKENS == snapshot, (\n        f\"BUG: REDIRECTION_TOKENS grew over 5 alias creates: \"\n        f\"{snapshot!r} -\u003e {constants.REDIRECTION_TOKENS!r}\"\n    )\n\n\ndef test_two_instances_alias_create_independence():\n    \"\"\"Two Cmd instances should not share corrupted REDIRECTION_TOKENS state.\"\"\"\n    snapshot = list(constants.REDIRECTION_TOKENS)\n    a = Cmd()\n    b = Cmd()\n    a.onecmd_plus_hooks(\"alias create x echo x\")\n    state_after_a = list(constants.REDIRECTION_TOKENS)\n    assert state_after_a == snapshot, (\n        f\"BUG: instance A mutated module-level REDIRECTION_TOKENS: \"\n        f\"{snapshot!r} -\u003e {state_after_a!r}; instance B sees the corruption\"\n    )\n```\n\nHappy to open a PR — it's a 4-line change. Found via [tailtest](https://tailtest.com) adversarial test generation.\n","author":{"url":"https://github.com/pramodavansaber","@type":"Person","name":"pramodavansaber"},"datePublished":"2026-04-24T03:24:37.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/1649/cmd2/issues/1649"}