shellharden

By default, Shellharden operates like cat, providing syntax highlighting in foreground colors and suggesting quoting changes using background colors:

• Foreground colors: Syntax highlighting.
• Background colors (green/red): Indicates characters that Shellharden would add (green) or remove (red) if the --transform option were used.

Apply changes automatically

To automatically rewrite a script to follow ShellCheck-style quoting conformance, use the --transform flag.

WARNING: Do not apply --transform blindly. A script that relies on unquoted behavior (like implicit word splitting or glob expansion) will break after transformation. Always perform a manual code review after using this flag.

You can install Shellharden using cargo from the official Rust package registry, or build it from source.

Via Cargo

cargo install shellharden

From Source

1. Build the release binary:

   cargo build --release

2. Move the binary to your local bin directory:
   ```bash
mv target/release/shellharden ~/.local/bin/

Avoid using -z or -n flags for string comparisons as they are less readable and can be ambiguous. Instead, use explicit string equality/inequality with quotes to ensure safety and readability.

Recommended (POSIX compliant):

test "$s" != ""
test "$s" = ""
[ "$s" != "" ]
[ "$s" = "" ]

Avoid (unreliable/unreadable):

test -n "$s"
test -z "$s"
test -n $s  # Always true if $s is unset or empty

Avoid using for i in $(command) because it relies on word splitting and can behave unexpectedly with spaces. Also, avoid piping into a loop (e.g., command | while read ...) because the pipe creates a subshell, preventing the loop from modifying variables in the parent scope.

Instead, use process substitution with a while read loop to keep the loop in the current shell context.

# Correct way to iterate over command output
while read -r i; do
    printf '%s\n' "$i"
done < <(seq 1 10)

To avoid vulnerabilities like word splitting and indirect pathname expansion, always wrap variable expansions and command substitutions in double quotes.

Word Splitting: Occurs when an unquoted variable is expanded, causing the shell to split the string into multiple arguments based on the characters in $IFS (whitespace by default). Indirect Pathname Expansion: Occurs when unquoted expansions contain wildcards (* or ?), causing the shell to expand them into matching filenames.

Exceptions where quoting is generally unnecessary:

• Variables with invariably numeric content: $?, $$, $!, $#, and array length ${#array[@]}.
• Assignments: a=$b.
• The case command: case $var in ... esac.
• Context within double brackets: [[ ... ]].

The echo command is fundamentally flawed because it interprets leading arguments as options and provides no way to suppress this parsing (unlike the -- delimiter in many other tools). To ensure data is printed exactly as intended, use printf.

Recommended pattern: Use printf '%s\n' "$var" to print a string followed by a newline.

Comparison:

If you want a reusable function, define a println helper:

println() {
    printf '%s\n' "$*"
}

printf '%s\n' "$var"
printf '%s' "$var"
printf '%s\r' "$var"
printf '%s %s\n' "$a" "$b"
printf '%s\n' "${array[*]}"

println() {
    printf '%s\n' "$*"
}

Avoid using the internal test operators -a (AND) and -o (OR) because they can lead to ambiguity if string content evaluates to operators. Instead, use the shell's native conjunction and disjunction operators (&&, ||, !) to combine separate test or [ commands.

Incorrect (Ambiguous):

test ! -e "$f" -a \( "$s" = yes -o "$s" = y \)

Correct (Unambiguous):

! test -e "$f" && { test "$s" = yes || test "$s" = y; }
! [ -e "$f" ] && { [ "$s" = yes ] || [ "$s" = y; }

When using set -e (errexit), assigning a value to a builtin like local or export in a single line can cause the script to fail if the command substitution fails, because the builtin itself is treated as the command being checked. To avoid this, separate the declaration from the assignment.

Incorrect:

set -e
local jobs="$(nproc)"

Correct:

set -e
local jobs
jobs="$(nproc)"

set -e # Fail if nproc is not installed
    local jobs
    jobs="$(nproc)"
    make -j"$jobs"

Curly braces {} serve two main purposes in Bash:

1. Variable Substitution: Required for specific operations like parameter expansion (e.g., "${image%.png}.jpg").
2. String Interpolation: Used to delimit the end of a variable name from subsequent characters in a string literal (e.g., "${var}string literal").

Note on Numbered Arguments: For positional parameters greater than 9, braces are mandatory (e.g., ${10}). Shellharden permits braces on all numbered arguments to avoid errors.

To check if a variable is set without relying on non-POSIX features like [[ -v var ]], use parameter expansion to provide a default value. This works even when set -u (nounset) is enabled.

POSIX approach (Default values):

• ${var-val}: Expands to val if var is unset.
• ${var:-val}: Expands to val if var is unset or empty.

Bash-specific approach:

• [[ -v var ]]: Returns true if var is set.

Avoid: Using test -n "$var" or [ -n "$var" ] to check existence, as these do not distinguish between a variable being unset and a variable being an empty string.