Showing 248 of 248 total issues

In POSIX sh, echo flags are undefined.
Open

    echo -n $"Stopping $prog: "
Severity: Minor
Found in bin/apel-ssm by shellcheck

In POSIX sh, something is undefined.

You have declared that your script works with /bin/sh, but you are using features that have undefined behavior according to the POSIX specification.

It may currently work for you, but it can or will fail on other OS, the same OS with different configurations, from different contexts (like initramfs/chroot), or in different versions of the same OS, including future updates to your current system.

Either declare that your script requires a specific shell like #!/bin/bash or #!/bin/dash, or rewrite the script in a portable way.

For help with rewrites, the Ubuntu wiki has a list of portability issues that broke people's #!/bin/sh scripts when Ubuntu switched from Bash to Dash. See also Bashism on wooledge's wiki. ShellCheck may not warn about all these issues.

$'c-style-escapes'

bash, ksh:

a=$' \t\n'

POSIX:

a="$(printf '%b_' ' \t\n')"; a="${a%_}" # protect trailing \n

Want some good news? See http://austingroupbugs.net/view.php?id=249#c590.

$"msgid"

Bash:

echo $"foo $(bar) baz"

POSIX:

. gettext.sh # GNU Gettext sh library
# ...
barout=$(bar)
eval_gettext 'foo $barout baz' # See GNU Gettext doc for more info.

Or you can change them to normal double quotes so you go without gettext.

Arithmetic for loops

Bash:

for ((init; test; next)); do foo; done

POSIX:

: $((init))
while [ $((test)) -ne 0 ]; do foo; : $((next)); done

Arithmetic exponentiation

Bash:

printf "%s\n" "$(( 2**63 ))"

POSIX:

The POSIX standard does not allow for exponents. However, you can replicate them completely built-in using a POSIX compatible function. As an example, the pow function from here.

pow () {
    set "$1" "$2" 1
    while [ "$2" -gt 0 ]; do
      set "$1" $(($2-1)) $(($1*$3))
    done
    # %d = signed decimal, %u = unsigned decimal
    # Either should overflow to 0
    printf "%d\n" "$3"
}

To compare:

$ echo "$(( 2**62 ))"
4611686018427387904
$ pow 2 62
4611686018427387904

Alternatively, if you don't mind using an external program, you can use bc. Be aware though: bash and other programs may abide by a certain maximum integer that bc does not (for bash that's: 64-bit signed long int, failing back to 32-bit signed long int).

Example:

# Note the overflow that gives a negative number
$ echo "$(( 2**63 ))"
-9223372036854775808

# No such problem
$ echo 2^63 | bc
9223372036854775808

# 'bc' just keeps on going
$ echo 2^1280 | bc
20815864389328798163850480654728171077230524494533409610638224700807\
21611934672059602447888346464836968484322790856201558276713249664692\
98162798132113546415258482590187784406915463666993231671009459188410\
95379622423387354295096957733925002768876520583464697770622321657076\
83317005651120933244966378183760369413644440628104205339687097746591\
6057756101739472373801429441421111406337458176

standalone ((..))

Bash:

((a=c+d))
((d)) && echo d is true.

POSIX:

: $((a=c+d)) # discard the output of the arith expn with `:` command
[ $((d)) -ne 0 ] && echo d is true. # manually check non-zero => true

select loops

It takes extra care over terminal columns to make select loop look like bash's, which generates a list with multiple items on one line, or like ls.

It is, however, still possible to make a naive translation for select foo in bar baz; do eat; done:

while
  _i=0 _foo= foo=
  for _name in bar baz; do echo "$((_i+=1))) $_name"; done
  printf '$# '; read _foo
do
  case _foo in 1) foo=bar;; 2) foo=baz;; *) continue;; esac
  eat
done

Here-strings

Bash, ksh:

grep aaa <<< "$g"

POSIX:

# not exactly the same -- <<< adds a trailing \n if $g doesn't end with \n
printf '%s' "$g" | grep aaa

echo flags

See https://unix.stackexchange.com/tags/echo/info.

${var/pat/replacement}

Bash:

echo "${TERM/%-256*}"

POSIX:

echo "$TERM" | sed -e 's/-256.*$//g'
# Special case for this since we are matching the end:
echo "${TERM%-256*}"

printf %q

Bash:

printf '%q ' "$@"

POSIX:

# TODO: Interpret it back to printf escapes for hard-to-copy chars like \t?
# See also: http://git.savannah.gnu.org/cgit/libtool.git/tree/gl/build-aux/funclib.sh?id=c60e054#n1029
reuse_quote()(
  for i; do
    __i_quote=$(printf '%s\n' "$i" | sed -e "s/'/'\\\\''/g"; echo x)
    printf "'%s'" "${__i_quote%x}"
  done
)
reuse_quote "$@"

Exception

Depends on what your expected POSIX shell providers would use.

Notice

Original content from the ShellCheck https://github.com/koalaman/shellcheck/wiki.

Line length
Open

The ARGO AMS Library is available in UMD as `python-argo-ams-library`. Versions above 0.5.0 are recommended.
Severity: Info
Found in migrating_to_ams.md by markdownlint

MD013 - Line length

Tags: line_length

Aliases: line-length Parameters: linelength, codeblocks, tables (number; default 80, boolean; default true)

This rule is triggered when there are lines that are longer than the configured line length (default: 80 characters). To fix this, split the line up into multiple lines.

This rule has an exception where there is no whitespace beyond the configured line length. This allows you to still include items such as long URLs without being forced to break them in the middle.

You also have the option to exclude this rule for code blocks and tables. To do this, set the code_blocks and/or tables parameters to false.

Code blocks are included in this rule by default since it is often a requirement for document readability, and tentatively compatible with code rules. Still, some languages do not lend themselves to short lines.

Fenced code blocks should be surrounded by blank lines
Open

   ```
Severity: Info
Found in migrating_to_ams.md by markdownlint

MD031 - Fenced code blocks should be surrounded by blank lines

Tags: code, blank_lines

Aliases: blanks-around-fences

This rule is triggered when fenced code blocks are either not preceded or not followed by a blank line:

Some text
```
Code block
```

```
Another code block
```
Some more text

To fix this, ensure that all fenced code blocks have a blank line both before and after (except where the block is at the beginning or end of the document):

Some text

```
Code block
```

```
Another code block
```

Some more text

Rationale: Aside from aesthetic reasons, some parsers, including kramdown, will not parse fenced code blocks that don't have blank lines before and after them.

Line too long (86 > 79 characters)
Open

    # Using the vars function to output a dict-like view rather than Namespace object.
Severity: Minor
Found in bin/sender.py by pep8

Limit all lines to a maximum of 79 characters.

There are still many devices around that are limited to 80 character
lines; plus, limiting windows to 80 characters makes it possible to
have several windows side-by-side.  The default wrapping on such
devices looks ugly.  Therefore, please limit all lines to a maximum
of 79 characters. For flowing long blocks of text (docstrings or
comments), limiting the length to 72 characters is recommended.

Reports error E501.

Line too long (83 > 79 characters)
Open

        logging.warning('Separate logging config file option has been deprecated.')
Severity: Minor
Found in bin/sender.py by pep8

Limit all lines to a maximum of 79 characters.

There are still many devices around that are limited to 80 character
lines; plus, limiting windows to 80 characters makes it possible to
have several windows side-by-side.  The default wrapping on such
devices looks ugly.  Therefore, please limit all lines to a maximum
of 79 characters. For flowing long blocks of text (docstrings or
comments), limiting the length to 72 characters is recommended.

Reports error E501.

Double quote to prevent globbing and word splitting.
Open

--iteration $ITERATION \
Severity: Minor
Found in scripts/ssm-build-deb.sh by shellcheck

Double quote to prevent globbing and word splitting.

Problematic code:

echo $1
for i in $*; do :; done # this done and the next one also applies to expanding arrays.
for i in $@; do :; done

Correct code:

echo "$1"
for i in "$@"; do :; done # or, 'for i; do'

Rationale

The first code looks like "print the first argument". It's actually "Split the first argument by IFS (spaces, tabs and line feeds). Expand each of them as if it was a glob. Join all the resulting strings and filenames with spaces. Print the result."

The second one looks like "iterate through all arguments". It's actually "join all the arguments by the first character of IFS (space), split them by IFS and expand each of them as globs, and iterate on the resulting list". The third one skips the joining part.

Quoting variables prevents word splitting and glob expansion, and prevents the script from breaking when input contains spaces, line feeds, glob characters and such.

Strictly speaking, only expansions themselves need to be quoted, but for stylistic reasons, entire arguments with multiple variable and literal parts are often quoted as one:

$HOME/$dir/dist/bin/$file        # Unquoted (bad)
"$HOME"/"$dir"/dist/bin/"$file"  # Minimal quoting (good)
"$HOME/$dir/dist/bin/$file"      # Canonical quoting (good)

When quoting composite arguments, make sure to exclude globs and brace expansions, which lose their special meaning in double quotes: "$HOME/$dir/src/*.c" will not expand, but "$HOME/$dir/src"/*.c will.

Note that $( ) starts a new context, and variables in it have to be quoted independently:

echo "This $variable is quoted $(but this $variable is not)"
echo "This $variable is quoted $(and now this "$variable" is too)"

Exceptions

Sometimes you want to split on spaces, like when building a command line:

options="-j 5 -B"
make $options file

Just quoting this doesn't work. Instead, you should have used an array (bash, ksh, zsh):

options=(-j 5 -B) # ksh: set -A options -- -j 5 -B
make "${options[@]}" file

or a function (POSIX):

make_with_flags() { make -j 5 -B "$@"; }
make_with_flags file

To split on spaces but not perform glob expansion, Posix has a set -f to disable globbing. You can disable word splitting by setting IFS=''.

Similarly, you might want an optional argument:

debug=""
[[ $1 == "--trace-commands" ]] && debug="-x"
bash $debug script

Quoting this doesn't work, since in the default case, "$debug" would expand to one empty argument while $debug would expand into zero arguments. In this case, you can use an array with zero or one elements as outlined above, or you can use an unquoted expansion with an alternate value:

debug=""
[[ $1 == "--trace-commands" ]] && debug="yes"
bash ${debug:+"-x"} script

This is better than an unquoted value because the alternative value can be properly quoted, e.g. wget ${output:+ -o "$output"}.


As always, this warning can be [[ignore]]d on a case-by-case basis.

this is especially relevant when BASH many not be available for the array work around. For example, use in eval or in command options where script has total control of the variables...

FLAGS="-av -e 'ssh -x' --delete --delete-excluded"
...
# shellcheck disable=SC2086
eval rsync $FLAGS ~/dir remote_host:dir

Notice

Original content from the ShellCheck https://github.com/koalaman/shellcheck/wiki.

Consider possible security implications associated with Popen module.
Open

from subprocess import Popen, PIPE


# logging configuration
Severity: Info
Found in ssm/crypto.py by bandit

Starting a process with a partial executable path
Open

        p1 = Popen(['openssl', 'smime', '-sign', '-inkey',
                    keypath, '-signer', certpath, '-text'],
                   stdin=PIPE, stdout=PIPE, stderr=PIPE,
                   universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

Starting a process with a partial executable path
Open

    p1 = Popen(['openssl', 'smime', '-encrypt', cipher, certpath],
               stdin=PIPE, stdout=PIPE, stderr=PIPE, universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

subprocess call - check for execution of untrusted input.
Open

        p1 = Popen(['openssl', 'smime', '-sign', '-inkey',
                    keypath, '-signer', certpath, '-text'],
                   stdin=PIPE, stdout=PIPE, stderr=PIPE,
                   universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

subprocess call - check for execution of untrusted input.
Open

    p1 = Popen(args, stdin=PIPE, stdout=PIPE, stderr=PIPE,
               universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

Starting a process with a partial executable path
Open

    p2 = Popen(['openssl', 'pkcs7', '-print_certs'], stdin=PIPE, stdout=PIPE,
               stderr=PIPE, universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

Possible hardcoded password: ''
Open

        token = ''

Severity: Info
Found in ssm/agents.py by bandit

subprocess call - check for execution of untrusted input.
Open

    p1 = Popen(['openssl', 'smime', '-pk7out'], stdin=PIPE, stdout=PIPE,
               stderr=PIPE, universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

Starting a process with a partial executable path
Open

    p1 = Popen(['openssl', 'smime', '-pk7out'], stdin=PIPE, stdout=PIPE,
               stderr=PIPE, universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

subprocess call - check for execution of untrusted input.
Open

    p1 = Popen(['openssl', 'smime', '-encrypt', cipher, certpath],
               stdin=PIPE, stdout=PIPE, stderr=PIPE, universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

subprocess call - check for execution of untrusted input.
Open

    p1 = Popen(['openssl', 'smime', '-verify', '-CApath', capath, '-noverify'],
               stdin=PIPE, stdout=PIPE, stderr=PIPE, universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

subprocess call - check for execution of untrusted input.
Open

    p1 = Popen(['openssl', 'smime', '-decrypt',
                '-recip', certpath, '-inkey', keypath],
               stdin=PIPE, stdout=PIPE, stderr=PIPE, universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

subprocess call - check for execution of untrusted input.
Open

    p1 = Popen(args, stdin=PIPE, stdout=PIPE, stderr=PIPE,
               universal_newlines=True)
Severity: Info
Found in ssm/crypto.py by bandit

Possible hardcoded password: ''
Open

            token = ''
Severity: Info
Found in ssm/agents.py by bandit
Severity
Category
Status
Source
Language