#530907 [checkbashisms] Better handle heredocs with non-quoted markers

Package:
devscripts
Source:
devscripts
Description:
scripts to make the life of a Debian Package maintainer easier
Submitter:
Raphael Geissert
Date:
2010-07-09 23:15:03 UTC
Severity:
normal
#530907#3
Date:
2009-05-28 00:11:24 UTC
From:
To:
Hi,

These are some of my findings based on the recent checkbashisms run:
(NOTE: a combined diff is attached)
-----------------
FP:
@@ -408,7 +409,7 @@ sub script_is_evil_and_wrong {
         last if (++$i > 55);
         if (m~
            # the exec should either be "eval"ed or a new statement
-           (^\s*|\beval\s*[\'\"]|(;|&&)\s*)
+           (^\s*|\beval\s*[\'\"]|(;|&&|\bthen)\s*)

            # eat anything between the exec and $0
            exec\s*.+\s*
-----------------
FP:

Workaround (this needs to be fixed by stripping evals, $(), ``, and any other
form of code execution and looking for bashisms in those parts individually):
Apply the same dummy logic used for "" and '' to $()

@@ -281,8 +282,8 @@ foreach my $filename (@ARGV) {
            # detect source (.) trying to pass args to the command it runs
            # The first expression weeds out '. "foo bar"'
            if (not $found and
-               not m/^\s*\.\s+(\"[^\"]+\"|\'[^\']+\')\s*(\&|\||\d?>|<|;|\Z)/
-               and m/^\s*(\.\s+[^\s;\`:]+\s+([^\s;]+))/) {
+               not m/^\s*\.\s+(\"[^\"]+\"|\'[^\']+\'|\$\([^)]+\)+)\s*(\&|\||
\d?>|<|;|\Z)/
+               and m/\s*(\.\s+[^\s;\`:]+\s+([^\s;]+))/) {
                if ($2 =~ /^(\&|\||\d?>|<)/) {
                    # everything is ok
                    ;
----------------- FN: @@ -281,8 +282,8 @@ foreach my $filename (@ARGV) { # detect source (.) trying to pass args to the command it runs # The first expression weeds out '. "foo bar"' if (not $found and - not m/^\s*\.\s+(\"[^\"]+\"|\'[^\']+\')\s*(\&|\||\d?>|<|;|\Z)/ - and m/^\s*(\.\s+[^\s;\`:]+\s+([^\s;]+))/) { + not m/$LEADIN\.\s+(\"[^\"]+\"|\'[^\']+\'|\$\([^)]+\)+)\s*(\&| \||\d?>|<|;|\Z)/ + and m/$LEADIN(\.\s+[^\s;\`:]+\s+([^\s;]+))/) { if ($2 =~ /^(\&|\||\d?>|<)/) { # everything is ok ; ----------------- Still to be fixed:
----------------- FP (new kind of wrapper): usr/share/doc/systemtap-doc/examples/process/errsnoop.stp:
----------------- FP (ref: #530084): @@ -408,7 +409,7 @@ sub script_is_evil_and_wrong { last if (++$i > 55); if (m~ # the exec should either be "eval"ed or a new statement - (^\s*|\beval\s*[\'\"]|(;|&&)\s*) + (^\s*|\beval\s*[\'\"]|(;|&&|\b(then|else))\s*) # eat anything between the exec and $0 exec\s*.+\s*
----------------- FN: Only here docs with quoted markers should be ignored. Cheers,
#530907#10
Date:
2010-07-09 22:57:46 UTC
From:
To:
Hi,

To clarify, the problem is that checkbashisms currently doesn't look for
certain bashisms in heredocs with non-quoted markers. Such bashisms can occur
inside $(), ``, and when using variables (e.g. $OSTYPE.)

To fully implement this, 530905 needs to be done too.

Cheers,