koalaman / shellcheck

ShellCheck, a static analysis tool for shell scripts
https://www.shellcheck.net
GNU General Public License v3.0
36.45k stars 1.78k forks source link

does not check for unescaped parenthesēs in certain contexts #2906

Open mirabilos opened 10 months ago

mirabilos commented 10 months ago

Here's a snippet or screenshot that shows the problem:

#!/bin/sh
line=x
  if [ "${line##*AC_CONFIG_AUX_DIR}" != "$line" ]; then
    dirprefix="${line##*([}"
    dirprefix="${dirprefix%%])*}"
    mkdir -p "${dirprefix}"
  fi

source

Here's what shellcheck currently says:

No issues detected!

Here's what I wanted or expected to see:

A warning about failure to quote the two parenthesēs with a backslash each:

    dirprefix="${line##*\([}"
    dirprefix="${dirprefix%%]\)*}"

This is mandatory because POSIX allows implementations to extend pattern matching in these situations (C.2.14.1 in the current Issue 8 draft specifically mentions the Korn shell extglob extension of *(…) in pattern matching).

Unfortunately, both GNU bash and dash allow this (and so mksh’s lksh binary on Debian when in sh mode does), so this mistake is very widespread. It would be good for shellcheck to flag this as error.

Thanks @lanodan for noting.