Sign upLogin

orange-cloudfoundry/cf-ops-automation

View on GitHub
Star

Showing 960 of 962 total issues

Double quote to prevent globbing and word splitting.
Open

bosh -n int ${VARS_FILES} ${OPS_FILES} "config-manifest/${CONFIG_TYPE}-config.yml" > "${BOSH_INTERPOLATED_FILE}"
Severity: Minor
Found in concourse/tasks/bosh_update_config/run.sh by shellcheck

Double quote to prevent globbing and word splitting.

Problematic code:

echo $1
for i in $*; do :; done # this done and the next one also applies to expanding arrays.
for i in $@; do :; done

Correct code:

echo "$1"
for i in "$@"; do :; done # or, 'for i; do'

Rationale

The first code looks like "print the first argument". It's actually "Split the first argument by IFS (spaces, tabs and line feeds). Expand each of them as if it was a glob. Join all the resulting strings and filenames with spaces. Print the result."

The second one looks like "iterate through all arguments". It's actually "join all the arguments by the first character of IFS (space), split them by IFS and expand each of them as globs, and iterate on the resulting list". The third one skips the joining part.

Quoting variables prevents word splitting and glob expansion, and prevents the script from breaking when input contains spaces, line feeds, glob characters and such.

Strictly speaking, only expansions themselves need to be quoted, but for stylistic reasons, entire arguments with multiple variable and literal parts are often quoted as one:

$HOME/$dir/dist/bin/$file        # Unquoted (bad)
"$HOME"/"$dir"/dist/bin/"$file"  # Minimal quoting (good)
"$HOME/$dir/dist/bin/$file"      # Canonical quoting (good)

When quoting composite arguments, make sure to exclude globs and brace expansions, which lose their special meaning in double quotes: "$HOME/$dir/src/*.c" will not expand, but "$HOME/$dir/src"/*.c will.

Note that $( ) starts a new context, and variables in it have to be quoted independently:

echo "This $variable is quoted $(but this $variable is not)"
echo "This $variable is quoted $(and now this "$variable" is too)"

Exceptions

Sometimes you want to split on spaces, like when building a command line:

options="-j 5 -B"
make $options file

Just quoting this doesn't work. Instead, you should have used an array (bash, ksh, zsh):

options=(-j 5 -B) # ksh: set -A options -- -j 5 -B
make "${options[@]}" file

or a function (POSIX):

make_with_flags() { make -j 5 -B "$@"; }
make_with_flags file

To split on spaces but not perform glob expansion, Posix has a set -f to disable globbing. You can disable word splitting by setting IFS=''.

Similarly, you might want an optional argument:

debug=""
[[ $1 == "--trace-commands" ]] && debug="-x"
bash $debug script

Quoting this doesn't work, since in the default case, "$debug" would expand to one empty argument while $debug would expand into zero arguments. In this case, you can use an array with zero or one elements as outlined above, or you can use an unquoted expansion with an alternate value:

debug=""
[[ $1 == "--trace-commands" ]] && debug="yes"
bash ${debug:+"-x"} script

This is better than an unquoted value because the alternative value can be properly quoted, e.g. wget ${output:+ -o "$output"}.

As always, this warning can be [[ignore]]d on a case-by-case basis.

this is especially relevant when BASH many not be available for the array work around. For example, use in eval or in command options where script has total control of the variables...

FLAGS="-av -e 'ssh -x' --delete --delete-excluded"
...
# shellcheck disable=SC2086
eval rsync $FLAGS ~/dir remote_host:dir

Notice

Original content from the ShellCheck https://github.com/koalaman/shellcheck/wiki.

Double quote to prevent globbing and word splitting.
Open

    chmod +x $CUSTOM_SCRIPT_DIR/post-deploy.sh
Severity: Minor
Found in concourse/tasks/post_deploy/run.sh by shellcheck

Double quote to prevent globbing and word splitting.

Problematic code:

echo $1
for i in $*; do :; done # this done and the next one also applies to expanding arrays.
for i in $@; do :; done

Correct code:

echo "$1"
for i in "$@"; do :; done # or, 'for i; do'

Rationale

The first code looks like "print the first argument". It's actually "Split the first argument by IFS (spaces, tabs and line feeds). Expand each of them as if it was a glob. Join all the resulting strings and filenames with spaces. Print the result."

The second one looks like "iterate through all arguments". It's actually "join all the arguments by the first character of IFS (space), split them by IFS and expand each of them as globs, and iterate on the resulting list". The third one skips the joining part.

Quoting variables prevents word splitting and glob expansion, and prevents the script from breaking when input contains spaces, line feeds, glob characters and such.

Strictly speaking, only expansions themselves need to be quoted, but for stylistic reasons, entire arguments with multiple variable and literal parts are often quoted as one:

$HOME/$dir/dist/bin/$file        # Unquoted (bad)
"$HOME"/"$dir"/dist/bin/"$file"  # Minimal quoting (good)
"$HOME/$dir/dist/bin/$file"      # Canonical quoting (good)

When quoting composite arguments, make sure to exclude globs and brace expansions, which lose their special meaning in double quotes: "$HOME/$dir/src/*.c" will not expand, but "$HOME/$dir/src"/*.c will.

Note that $( ) starts a new context, and variables in it have to be quoted independently:

echo "This $variable is quoted $(but this $variable is not)"
echo "This $variable is quoted $(and now this "$variable" is too)"

Exceptions

Sometimes you want to split on spaces, like when building a command line:

options="-j 5 -B"
make $options file

Just quoting this doesn't work. Instead, you should have used an array (bash, ksh, zsh):

options=(-j 5 -B) # ksh: set -A options -- -j 5 -B
make "${options[@]}" file

or a function (POSIX):

make_with_flags() { make -j 5 -B "$@"; }
make_with_flags file

To split on spaces but not perform glob expansion, Posix has a set -f to disable globbing. You can disable word splitting by setting IFS=''.

Similarly, you might want an optional argument:

debug=""
[[ $1 == "--trace-commands" ]] && debug="-x"
bash $debug script

Quoting this doesn't work, since in the default case, "$debug" would expand to one empty argument while $debug would expand into zero arguments. In this case, you can use an array with zero or one elements as outlined above, or you can use an unquoted expansion with an alternate value:

debug=""
[[ $1 == "--trace-commands" ]] && debug="yes"
bash ${debug:+"-x"} script

This is better than an unquoted value because the alternative value can be properly quoted, e.g. wget ${output:+ -o "$output"}.

As always, this warning can be [[ignore]]d on a case-by-case basis.

this is especially relevant when BASH many not be available for the array work around. For example, use in eval or in command options where script has total control of the variables...

FLAGS="-av -e 'ssh -x' --delete --delete-excluded"
...
# shellcheck disable=SC2086
eval rsync $FLAGS ~/dir remote_host:dir

Notice

Original content from the ShellCheck https://github.com/koalaman/shellcheck/wiki.

Double quote to prevent globbing and word splitting.
Open

Severity: Minor
Found in init-template.sh by shellcheck

Double quote to prevent globbing and word splitting.

Problematic code:

echo $1
for i in $*; do :; done # this done and the next one also applies to expanding arrays.
for i in $@; do :; done

Correct code:

echo "$1"
for i in "$@"; do :; done # or, 'for i; do'

Rationale

The first code looks like "print the first argument". It's actually "Split the first argument by IFS (spaces, tabs and line feeds). Expand each of them as if it was a glob. Join all the resulting strings and filenames with spaces. Print the result."

The second one looks like "iterate through all arguments". It's actually "join all the arguments by the first character of IFS (space), split them by IFS and expand each of them as globs, and iterate on the resulting list". The third one skips the joining part.

Quoting variables prevents word splitting and glob expansion, and prevents the script from breaking when input contains spaces, line feeds, glob characters and such.

Strictly speaking, only expansions themselves need to be quoted, but for stylistic reasons, entire arguments with multiple variable and literal parts are often quoted as one:

$HOME/$dir/dist/bin/$file        # Unquoted (bad)
"$HOME"/"$dir"/dist/bin/"$file"  # Minimal quoting (good)
"$HOME/$dir/dist/bin/$file"      # Canonical quoting (good)

When quoting composite arguments, make sure to exclude globs and brace expansions, which lose their special meaning in double quotes: "$HOME/$dir/src/*.c" will not expand, but "$HOME/$dir/src"/*.c will.

Note that $( ) starts a new context, and variables in it have to be quoted independently:

echo "This $variable is quoted $(but this $variable is not)"
echo "This $variable is quoted $(and now this "$variable" is too)"

Exceptions

Sometimes you want to split on spaces, like when building a command line:

options="-j 5 -B"
make $options file

Just quoting this doesn't work. Instead, you should have used an array (bash, ksh, zsh):

options=(-j 5 -B) # ksh: set -A options -- -j 5 -B
make "${options[@]}" file

or a function (POSIX):

make_with_flags() { make -j 5 -B "$@"; }
make_with_flags file

To split on spaces but not perform glob expansion, Posix has a set -f to disable globbing. You can disable word splitting by setting IFS=''.

Similarly, you might want an optional argument:

debug=""
[[ $1 == "--trace-commands" ]] && debug="-x"
bash $debug script

Quoting this doesn't work, since in the default case, "$debug" would expand to one empty argument while $debug would expand into zero arguments. In this case, you can use an array with zero or one elements as outlined above, or you can use an unquoted expansion with an alternate value:

debug=""
[[ $1 == "--trace-commands" ]] && debug="yes"
bash ${debug:+"-x"} script

This is better than an unquoted value because the alternative value can be properly quoted, e.g. wget ${output:+ -o "$output"}.

As always, this warning can be [[ignore]]d on a case-by-case basis.

this is especially relevant when BASH many not be available for the array work around. For example, use in eval or in command options where script has total control of the variables...

FLAGS="-av -e 'ssh -x' --delete --delete-excluded"
...
# shellcheck disable=SC2086
eval rsync $FLAGS ~/dir remote_host:dir

Notice

Original content from the ShellCheck https://github.com/koalaman/shellcheck/wiki.

Double quote to prevent globbing and word splitting.
Open

Severity: Minor
Found in init-template.sh by shellcheck

Double quote to prevent globbing and word splitting.

Problematic code:

echo $1
for i in $*; do :; done # this done and the next one also applies to expanding arrays.
for i in $@; do :; done

Correct code:

echo "$1"
for i in "$@"; do :; done # or, 'for i; do'

Rationale

The first code looks like "print the first argument". It's actually "Split the first argument by IFS (spaces, tabs and line feeds). Expand each of them as if it was a glob. Join all the resulting strings and filenames with spaces. Print the result."

The second one looks like "iterate through all arguments". It's actually "join all the arguments by the first character of IFS (space), split them by IFS and expand each of them as globs, and iterate on the resulting list". The third one skips the joining part.

Quoting variables prevents word splitting and glob expansion, and prevents the script from breaking when input contains spaces, line feeds, glob characters and such.

Strictly speaking, only expansions themselves need to be quoted, but for stylistic reasons, entire arguments with multiple variable and literal parts are often quoted as one:

$HOME/$dir/dist/bin/$file        # Unquoted (bad)
"$HOME"/"$dir"/dist/bin/"$file"  # Minimal quoting (good)
"$HOME/$dir/dist/bin/$file"      # Canonical quoting (good)

When quoting composite arguments, make sure to exclude globs and brace expansions, which lose their special meaning in double quotes: "$HOME/$dir/src/*.c" will not expand, but "$HOME/$dir/src"/*.c will.

Note that $( ) starts a new context, and variables in it have to be quoted independently:

echo "This $variable is quoted $(but this $variable is not)"
echo "This $variable is quoted $(and now this "$variable" is too)"

Exceptions

Sometimes you want to split on spaces, like when building a command line:

options="-j 5 -B"
make $options file

Just quoting this doesn't work. Instead, you should have used an array (bash, ksh, zsh):

options=(-j 5 -B) # ksh: set -A options -- -j 5 -B
make "${options[@]}" file

or a function (POSIX):

make_with_flags() { make -j 5 -B "$@"; }
make_with_flags file

To split on spaces but not perform glob expansion, Posix has a set -f to disable globbing. You can disable word splitting by setting IFS=''.

Similarly, you might want an optional argument:

debug=""
[[ $1 == "--trace-commands" ]] && debug="-x"
bash $debug script

Quoting this doesn't work, since in the default case, "$debug" would expand to one empty argument while $debug would expand into zero arguments. In this case, you can use an array with zero or one elements as outlined above, or you can use an unquoted expansion with an alternate value:

debug=""
[[ $1 == "--trace-commands" ]] && debug="yes"
bash ${debug:+"-x"} script

This is better than an unquoted value because the alternative value can be properly quoted, e.g. wget ${output:+ -o "$output"}.

As always, this warning can be [[ignore]]d on a case-by-case basis.

this is especially relevant when BASH many not be available for the array work around. For example, use in eval or in command options where script has total control of the variables...

FLAGS="-av -e 'ssh -x' --delete --delete-excluded"
...
# shellcheck disable=SC2086
eval rsync $FLAGS ~/dir remote_host:dir

Notice

Original content from the ShellCheck https://github.com/koalaman/shellcheck/wiki.

TODO found
Open

{"gherkinDocument":{"uri":"features/cf_app_deployment_environment_variable_available.feature","feature":{"location":{"line":1,"column":1},"tags":[],"language":"en","keyword":"Feature","name":"Cf application deployment support","description":"  In order to know how to deploy a CF application\n  As a paas-template user,\n  I want to know which environment varaiables are availlable","children":[{"background":{"location":{"line":6,"column":3},"keyword":"Background","name":"","description":"","steps":[{"location":{"line":7,"column":5},"keyword":"Given ","text":"Hello world generated pipelines from reference_dataset","id":"b7ea8156-b790-4b68-a2b5-7e771c16f896"}],"id":"34e373a8-9e28-4f11-a3e9-9ccdc77d52b5"}},{"scenario":{"location":{"line":9,"column":3},"tags":[],"keyword":"Scenario","name":"a deployment, or a part, is done using a concourse pipeline","description":"","steps":[{"location":{"line":10,"column":5},"keyword":"But ","text":"needs documentation","id":"7966ef57-5747-4c39-9419-82e2ed4aa157"}],"examples":[],"id":"f33ee53b-6f32-4db3-972e-82e4d2d4581e"}}]},"comments":[{"location":{"line":11,"column":1},"text":"#    Then the following environment variables exist:"},{"location":{"line":12,"column":1},"text":"#      | name              | description                                                                     |"},{"location":{"line":13,"column":1},"text":"#      | GENERATE_DIR      | directory holding generated files. It's an absolute path.                       |"},{"location":{"line":14,"column":1},"text":"#      | BASE_TEMPLATE_DIR | directory where `pre-cf-push.sh` is located. It's an relative path.             |"},{"location":{"line":15,"column":1},"text":"#      | SECRETS_DIR       | directory holding secrets related to current deployment. It's an relative path. |"},{"location":{"line":16,"column":1},"text":"#      | CF_API_URL        | current application Cloud Foundry API url                                       |"},{"location":{"line":17,"column":1},"text":"#      | CF_USERNAME       | current Cloud Foundry application user                                          |"},{"location":{"line":18,"column":1},"text":"#      | CF_PASSWORD       | current Cloud Foundry application user password                                 |"},{"location":{"line":19,"column":1},"text":"#      | CF_ORG            | current Cloud Foundry application organization                                  |"},{"location":{"line":20,"column":1},"text":"#      | CF_SPACE          | current Cloud Foundry application space                                         |"},{"location":{"line":21,"column":1},"text":"#      | CUSTOM_SCRIPT_DIR | TODO                                         |"},{"location":{"line":22,"column":1},"text":"#      | CF_MANIFEST       | TODO                                         |"},{"location":{"line":23,"column":1},"text":"#"}]}},
Severity: Minor
Found in docs/features/features.html by fixme

TODO found
Open

# TODO: add docu + usage
Severity: Minor
Found in scripts/bootstrap_coa_env.rb by fixme

FIXME found
Open

            # FIXME: replace all occurrences of 'example.com' with your server's FQDN
Severity: Minor
Found in docs/reference_dataset/template_repository/another-world-root-depls/another-bosh-deployment-sample/template/another-bosh-deployment-sample-tpl.yml by fixme

TODO found
Open

{"source":{"uri":"features/cf_app_deployment_environment_variable_available.feature","data":"Feature: Cf application deployment support\n  In order to know how to deploy a CF application\n  As a paas-template user,\n  I want to know which environment varaiables are availlable\n\n  Background:\n    Given Hello world generated pipelines from reference_dataset\n\n  Scenario: a deployment, or a part, is done using a concourse pipeline\n    But needs documentation\n#    Then the following environment variables exist:\n#      | name              | description                                                                     |\n#      | GENERATE_DIR      | directory holding generated files. It's an absolute path.                       |\n#      | BASE_TEMPLATE_DIR | directory where `pre-cf-push.sh` is located. It's an relative path.             |\n#      | SECRETS_DIR       | directory holding secrets related to current deployment. It's an relative path. |\n#      | CF_API_URL        | current application Cloud Foundry API url                                       |\n#      | CF_USERNAME       | current Cloud Foundry application user                                          |\n#      | CF_PASSWORD       | current Cloud Foundry application user password                                 |\n#      | CF_ORG            | current Cloud Foundry application organization                                  |\n#      | CF_SPACE          | current Cloud Foundry application space                                         |\n#      | CUSTOM_SCRIPT_DIR | TODO                                         |\n#      | CF_MANIFEST       | TODO                                         |\n#\n","mediaType":"text/x.cucumber.gherkin+plain"}},
Severity: Minor
Found in docs/features/features.html by fixme

TODO found
Open

{"source":{"uri":"features/cf_app_deployment_environment_variable_available.feature","data":"Feature: Cf application deployment support\n  In order to know how to deploy a CF application\n  As a paas-template user,\n  I want to know which environment varaiables are availlable\n\n  Background:\n    Given Hello world generated pipelines from reference_dataset\n\n  Scenario: a deployment, or a part, is done using a concourse pipeline\n    But needs documentation\n#    Then the following environment variables exist:\n#      | name              | description                                                                     |\n#      | GENERATE_DIR      | directory holding generated files. It's an absolute path.                       |\n#      | BASE_TEMPLATE_DIR | directory where `pre-cf-push.sh` is located. It's an relative path.             |\n#      | SECRETS_DIR       | directory holding secrets related to current deployment. It's an relative path. |\n#      | CF_API_URL        | current application Cloud Foundry API url                                       |\n#      | CF_USERNAME       | current Cloud Foundry application user                                          |\n#      | CF_PASSWORD       | current Cloud Foundry application user password                                 |\n#      | CF_ORG            | current Cloud Foundry application organization                                  |\n#      | CF_SPACE          | current Cloud Foundry application space                                         |\n#      | CUSTOM_SCRIPT_DIR | TODO                                         |\n#      | CF_MANIFEST       | TODO                                         |\n#\n","mediaType":"text/x.cucumber.gherkin+plain"}},
Severity: Minor
Found in docs/features/features.html by fixme

TODO found
Open

#      | CF_MANIFEST       | TODO                                         |
Severity: Minor
Found in docs/features/features.md by fixme

TODO found
Open

# TODO: install bucc if not present and needed
Severity: Minor
Found in scripts/bootstrap_coa_env.rb by fixme

FIXME found
Open

            # FIXME: replace all occurrences of 'example.com' with your server's FQDN
Severity: Minor
Found in docs/reference_dataset/template_repository/hello-world-root-depls/bosh-deployment-sample/template/bosh-deployment-sample-tpl.yml by fixme

TODO found
Open

{"gherkinDocument":{"uri":"features/cf_app_deployment_environment_variable_available.feature","feature":{"location":{"line":1,"column":1},"tags":[],"language":"en","keyword":"Feature","name":"Cf application deployment support","description":"  In order to know how to deploy a CF application\n  As a paas-template user,\n  I want to know which environment varaiables are availlable","children":[{"background":{"location":{"line":6,"column":3},"keyword":"Background","name":"","description":"","steps":[{"location":{"line":7,"column":5},"keyword":"Given ","text":"Hello world generated pipelines from reference_dataset","id":"b7ea8156-b790-4b68-a2b5-7e771c16f896"}],"id":"34e373a8-9e28-4f11-a3e9-9ccdc77d52b5"}},{"scenario":{"location":{"line":9,"column":3},"tags":[],"keyword":"Scenario","name":"a deployment, or a part, is done using a concourse pipeline","description":"","steps":[{"location":{"line":10,"column":5},"keyword":"But ","text":"needs documentation","id":"7966ef57-5747-4c39-9419-82e2ed4aa157"}],"examples":[],"id":"f33ee53b-6f32-4db3-972e-82e4d2d4581e"}}]},"comments":[{"location":{"line":11,"column":1},"text":"#    Then the following environment variables exist:"},{"location":{"line":12,"column":1},"text":"#      | name              | description                                                                     |"},{"location":{"line":13,"column":1},"text":"#      | GENERATE_DIR      | directory holding generated files. It's an absolute path.                       |"},{"location":{"line":14,"column":1},"text":"#      | BASE_TEMPLATE_DIR | directory where `pre-cf-push.sh` is located. It's an relative path.             |"},{"location":{"line":15,"column":1},"text":"#      | SECRETS_DIR       | directory holding secrets related to current deployment. It's an relative path. |"},{"location":{"line":16,"column":1},"text":"#      | CF_API_URL        | current application Cloud Foundry API url                                       |"},{"location":{"line":17,"column":1},"text":"#      | CF_USERNAME       | current Cloud Foundry application user                                          |"},{"location":{"line":18,"column":1},"text":"#      | CF_PASSWORD       | current Cloud Foundry application user password                                 |"},{"location":{"line":19,"column":1},"text":"#      | CF_ORG            | current Cloud Foundry application organization                                  |"},{"location":{"line":20,"column":1},"text":"#      | CF_SPACE          | current Cloud Foundry application space                                         |"},{"location":{"line":21,"column":1},"text":"#      | CUSTOM_SCRIPT_DIR | TODO                                         |"},{"location":{"line":22,"column":1},"text":"#      | CF_MANIFEST       | TODO                                         |"},{"location":{"line":23,"column":1},"text":"#"}]}},
Severity: Minor
Found in docs/features/features.html by fixme

TODO found
Open

  - TODO
Severity: Minor
Found in scripts/prepare_hotfix_release.rb by fixme

TODO found
Open

#### TODO
Severity: Minor
Found in docs/reference_dataset/README.md by fixme

TODO found
Open

# TODO: add docu + usage
Severity: Minor
Found in scripts/run_integration_tests.rb by fixme

TODO found
Open

#TODO add an option to manage ssl validation
Severity: Minor
Found in scripts/cf/push.sh by fixme

TODO found
Open

#      | CUSTOM_SCRIPT_DIR | TODO                                         |
Severity: Minor
Found in docs/features/features.md by fixme

TODO found
Open

#      | CF_MANIFEST       | TODO                                         |
Severity: Minor
Found in features/cf_app_deployment_environment_variable_available.feature by fixme

TODO found
Open

#      | CUSTOM_SCRIPT_DIR | TODO                                         |
Severity: Minor
Found in features/cf_app_deployment_environment_variable_available.feature by fixme
Severity
Category
Status
Source
Language