#530906 [checkbashisms] Detect shellscript wrappers using env

Package:
devscripts
Source:
devscripts
Description:
scripts to make the life of a Debian Package maintainer easier
Submitter:
Raphael Geissert
Date:
2010-07-09 21:39:05 UTC
Severity:
normal
#530906#3
Date:
2009-05-28 00:11:24 UTC
From:
To:
Hi,

These are some of my findings based on the recent checkbashisms run:
(NOTE: a combined diff is attached)
-----------------
FP:
@@ -408,7 +409,7 @@ sub script_is_evil_and_wrong {
         last if (++$i > 55);
         if (m~
            # the exec should either be "eval"ed or a new statement
-           (^\s*|\beval\s*[\'\"]|(;|&&)\s*)
+           (^\s*|\beval\s*[\'\"]|(;|&&|\bthen)\s*)

            # eat anything between the exec and $0
            exec\s*.+\s*
-----------------
FP:

Workaround (this needs to be fixed by stripping evals, $(), ``, and any other
form of code execution and looking for bashisms in those parts individually):
Apply the same dummy logic used for "" and '' to $()

@@ -281,8 +282,8 @@ foreach my $filename (@ARGV) {
            # detect source (.) trying to pass args to the command it runs
            # The first expression weeds out '. "foo bar"'
            if (not $found and
-               not m/^\s*\.\s+(\"[^\"]+\"|\'[^\']+\')\s*(\&|\||\d?>|<|;|\Z)/
-               and m/^\s*(\.\s+[^\s;\`:]+\s+([^\s;]+))/) {
+               not m/^\s*\.\s+(\"[^\"]+\"|\'[^\']+\'|\$\([^)]+\)+)\s*(\&|\||
\d?>|<|;|\Z)/
+               and m/\s*(\.\s+[^\s;\`:]+\s+([^\s;]+))/) {
                if ($2 =~ /^(\&|\||\d?>|<)/) {
                    # everything is ok
                    ;
----------------- FN: @@ -281,8 +282,8 @@ foreach my $filename (@ARGV) { # detect source (.) trying to pass args to the command it runs # The first expression weeds out '. "foo bar"' if (not $found and - not m/^\s*\.\s+(\"[^\"]+\"|\'[^\']+\')\s*(\&|\||\d?>|<|;|\Z)/ - and m/^\s*(\.\s+[^\s;\`:]+\s+([^\s;]+))/) { + not m/$LEADIN\.\s+(\"[^\"]+\"|\'[^\']+\'|\$\([^)]+\)+)\s*(\&| \||\d?>|<|;|\Z)/ + and m/$LEADIN(\.\s+[^\s;\`:]+\s+([^\s;]+))/) { if ($2 =~ /^(\&|\||\d?>|<)/) { # everything is ok ; ----------------- Still to be fixed:
----------------- FP (new kind of wrapper): usr/share/doc/systemtap-doc/examples/process/errsnoop.stp:
----------------- FP (ref: #530084): @@ -408,7 +409,7 @@ sub script_is_evil_and_wrong { last if (++$i > 55); if (m~ # the exec should either be "eval"ed or a new statement - (^\s*|\beval\s*[\'\"]|(;|&&)\s*) + (^\s*|\beval\s*[\'\"]|(;|&&|\b(then|else))\s*) # eat anything between the exec and $0 exec\s*.+\s*
----------------- FN: Only here docs with quoted markers should be ignored. Cheers,
#530906#12
Date:
2010-07-06 22:43:38 UTC
From:
To:
checkbashisms doesn't complain about this, using either the current
version or the version this bug was reported against (2.10.49).  I'd be
glad to close this, but I'm wondering if you recall what the problem
was.

#530906#17
Date:
2010-07-06 23:20:25 UTC
From:
To:
In fact, no released version of checkbashisms has issued a warning on a
script like the one shown.  Closing.

#530906#20
Date:
2010-07-09 21:36:10 UTC
From:
To:
reopen 530906
thanks

Hi James,

This is not about checkbashisms warning about anything. The problem is that it
doesn't recognise the above as a "shell wrapper," which (in that case) then
leads to false positives.