bashrs 6.66.0

Rust-to-Shell transpiler for deterministic bootstrap scripts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144

// SC2156: Injecting filenames is fragile and insecure. Use * or ${array[@]}.
//
// Dynamically constructing filenames from command substitution is unsafe.
// Use glob patterns or arrays instead.
//
// Examples:
// Bad:
//   for file in $(ls); do           // Breaks on spaces, unsafe
//   rm $(find . -name "*.txt")      // Word splitting, unsafe
//
// Good:
//   for file in *; do               // Glob expansion, safe
//   find . -name "*.txt" -delete    // Direct action
//   files=(*.txt); rm "${files[@]}" // Array, safe
//
// Impact: Security and correctness issues with filenames

use crate::linter::{Diagnostic, LintResult, Severity, Span};
use regex::Regex;

static COMMAND_SUB_IN_FOR: std::sync::LazyLock<Regex> =
    std::sync::LazyLock::new(|| Regex::new(r"\bfor\s+\w+\s+in\s+\$\(").unwrap());

static UNQUOTED_COMMAND_SUB: std::sync::LazyLock<Regex> =
    std::sync::LazyLock::new(|| Regex::new(r"\b(rm|mv|cp)\s+\$\((find|ls)\b").unwrap());

pub fn check(source: &str) -> LintResult {
    let mut result = LintResult::new();

    for (line_num, line) in source.lines().enumerate() {
        let line_num = line_num + 1;

        if line.trim_start().starts_with('#') {
            continue;
        }

        // Check for command substitution in for loops
        for mat in COMMAND_SUB_IN_FOR.find_iter(line) {
            let start_col = mat.start() + 1;
            let end_col = mat.end() + 1;

            let diagnostic = Diagnostic::new(
                "SC2156",
                Severity::Warning,
                "Injecting filenames is fragile. Use globs or arrays instead".to_string(),
                Span::new(line_num, start_col, line_num, end_col),
            );

            result.add(diagnostic);
        }

        // Check for unquoted command sub with file operations
        for mat in UNQUOTED_COMMAND_SUB.find_iter(line) {
            let start_col = mat.start() + 1;
            let end_col = mat.end() + 1;

            let diagnostic = Diagnostic::new(
                "SC2156",
                Severity::Warning,
                "Injecting filenames is fragile. Use -exec or xargs instead".to_string(),
                Span::new(line_num, start_col, line_num, end_col),
            );

            result.add(diagnostic);
        }
    }

    result
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_sc2156_for_ls() {
        let code = "for file in $(ls); do";
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 1);
    }

    #[test]
    fn test_sc2156_for_find() {
        let code = "for file in $(find . -name '*.txt'); do";
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 1);
    }

    #[test]
    fn test_sc2156_rm_find() {
        let code = "rm $(find . -name '*.txt')";
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 1);
    }

    #[test]
    fn test_sc2156_for_glob_ok() {
        let code = "for file in *.txt; do";
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 0);
    }

    #[test]
    fn test_sc2156_for_array_ok() {
        let code = r#"for file in "${files[@]}"; do"#;
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 0);
    }

    #[test]
    fn test_sc2156_find_delete_ok() {
        let code = "find . -name '*.txt' -delete";
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 0);
    }

    #[test]
    fn test_sc2156_comment_ok() {
        let code = "# for file in $(ls); do";
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 0);
    }

    #[test]
    fn test_sc2156_mv_find() {
        let code = "mv $(find . -type f) /tmp/";
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 1);
    }

    #[test]
    fn test_sc2156_cp_ls() {
        let code = "cp $(ls *.txt) backup/";
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 1);
    }

    #[test]
    fn test_sc2156_multiple() {
        let code = "for f in $(ls)\nrm $(find .)";
        let result = check(code);
        assert_eq!(result.diagnostics.len(), 2);
    }
}