├── .gitignore ├── LICENSE ├── README.md ├── bin └── shlint ├── lib ├── checkbashisms └── shlint └── shlint.gemspec /.gitignore: -------------------------------------------------------------------------------- 1 | *.swp 2 | *.gem 3 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright (c) 2012 Ross Duggan 2 | 3 | Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: 4 | 5 | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. 6 | 7 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 8 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | #shlint - shell linting utility. 2 | 3 | [![No Maintenance Intended](http://unmaintained.tech/badge.svg)](http://unmaintained.tech/) 4 | 5 | Shlint uses locally available shells to test a shellscript for 6 | portability issues. It also runs `checkbashisms` against the code. 7 | 8 | Default shells tested are: 9 | zsh ksh bash dash sh 10 | 11 | ## Customize testing 12 | Place a .shlintrc file in your homedir to override default shells. 13 | This is expected to be shell syntax, specified as: 14 | 15 | ``` 16 | shlint_shells="list installed shells here separated by spaces" 17 | ``` 18 | 19 | ## OSX Users: 20 | Use brew (http://mxcl.github.com/homebrew/) to install additional 21 | shells if you're missing any. 22 | 23 | ## Install 24 | If you're a ruby user, can install using `gem install shlint` 25 | 26 | Any other nix platform, just drop the contents of `lib` into your `$PATH` 27 | 28 | ## Resources 29 | 30 | * [Portable Shell Programming](http://www.gnu.org/software/autoconf/manual/autoconf.html#Portable-Shell) 31 | * [How to make bash scripts work in dash](http://mywiki.wooledge.org/Bashism) 32 | * [POSIX shell specification](http://pubs.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html) 33 | * [Debian devscripts repository](http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git) 34 | -------------------------------------------------------------------------------- /bin/shlint: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | 3 | gem_root = File.dirname(__FILE__) + "/.." 4 | 5 | # Change pwd in order invoke lib/checkbashisms 6 | Dir.chdir(gem_root) 7 | 8 | shell_output = "" 9 | IO.popen("lib/shlint #{ARGV.join(" ")}", 'r+') do |pipe| 10 | pipe.close_write 11 | shell_output = pipe.read 12 | end 13 | 14 | puts shell_output 15 | 16 | exit $?.exitstatus 17 | -------------------------------------------------------------------------------- /lib/checkbashisms: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl -w 2 | 3 | # This script is essentially copied from /usr/share/lintian/checks/scripts, 4 | # which is: 5 | # Copyright (C) 1998 Richard Braakman 6 | # Copyright (C) 2002 Josip Rodin 7 | # This version is 8 | # Copyright (C) 2003 Julian Gilbey 9 | # 10 | # This program is free software; you can redistribute it and/or modify 11 | # it under the terms of the GNU General Public License as published by 12 | # the Free Software Foundation; either version 2 of the License, or 13 | # (at your option) any later version. 14 | # 15 | # This program is distributed in the hope that it will be useful, 16 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 17 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18 | # GNU General Public License for more details. 19 | # 20 | # You should have received a copy of the GNU General Public License 21 | # along with this program. If not, see . 22 | 23 | use strict; 24 | use Getopt::Long qw(:config gnu_getopt); 25 | use File::Temp qw/tempfile/; 26 | 27 | sub init_hashes; 28 | 29 | (my $progname = $0) =~ s|.*/||; 30 | 31 | my $usage = <<"EOF"; 32 | Usage: $progname [-n] [-f] [-x] script ... 33 | or: $progname --help 34 | or: $progname --version 35 | This script performs basic checks for the presence of bashisms 36 | in /bin/sh scripts and the lack of bashisms in /bin/bash ones. 37 | EOF 38 | 39 | my $version = <<"EOF"; 40 | This is $progname, from the Debian devscripts package, version ###VERSION### 41 | This code is copyright 2003 by Julian Gilbey , 42 | based on original code which is copyright 1998 by Richard Braakman 43 | and copyright 2002 by Josip Rodin. 44 | This program comes with ABSOLUTELY NO WARRANTY. 45 | You are free to redistribute this code under the terms of the 46 | GNU General Public License, version 2, or (at your option) any later version. 47 | EOF 48 | 49 | my ($opt_echo, $opt_force, $opt_extra, $opt_posix); 50 | my ($opt_help, $opt_version); 51 | my @filenames; 52 | 53 | # Detect if STDIN is a pipe 54 | if (scalar(@ARGV) == 0 && (-p STDIN or -f STDIN)) { 55 | push(@ARGV, '-'); 56 | } 57 | 58 | ## 59 | ## handle command-line options 60 | ## 61 | $opt_help = 1 if int(@ARGV) == 0; 62 | 63 | GetOptions("help|h" => \$opt_help, 64 | "version|v" => \$opt_version, 65 | "newline|n" => \$opt_echo, 66 | "force|f" => \$opt_force, 67 | "extra|x" => \$opt_extra, 68 | "posix|p" => \$opt_posix, 69 | ) 70 | or die "Usage: $progname [options] filelist\nRun $progname --help for more details\n"; 71 | 72 | if ($opt_help) { print $usage; exit 0; } 73 | if ($opt_version) { print $version; exit 0; } 74 | 75 | $opt_echo = 1 if $opt_posix; 76 | 77 | my $mode = 0; 78 | my $issues = 0; 79 | my $status = 0; 80 | my $makefile = 0; 81 | my (%bashisms, %string_bashisms, %singlequote_bashisms); 82 | 83 | my $LEADIN = qr'(?:(?:^|[`&;(|{])\s*|(?:if|then|do|while|shell)\s+)'; 84 | init_hashes; 85 | 86 | my @bashisms_keys = sort keys %bashisms; 87 | my @string_bashisms_keys = sort keys %string_bashisms; 88 | my @singlequote_bashisms_keys = sort keys %singlequote_bashisms; 89 | 90 | foreach my $filename (@ARGV) { 91 | my $check_lines_count = -1; 92 | 93 | my $display_filename = $filename; 94 | 95 | if ($filename eq '-') { 96 | my $tmp_fh; 97 | ($tmp_fh, $filename) = tempfile("chkbashisms_tmp.XXXX", TMPDIR => 1, UNLINK => 1); 98 | while (my $line = ) { 99 | print $tmp_fh $line; 100 | } 101 | close($tmp_fh); 102 | $display_filename = "(stdin)"; 103 | } 104 | 105 | if (!$opt_force) { 106 | $check_lines_count = script_is_evil_and_wrong($filename); 107 | } 108 | 109 | if ($check_lines_count == 0 or $check_lines_count == 1) { 110 | warn "script $display_filename does not appear to be a /bin/sh script; skipping\n"; 111 | next; 112 | } 113 | 114 | if ($check_lines_count != -1) { 115 | warn "script $display_filename appears to be a shell wrapper; only checking the first " 116 | . "$check_lines_count lines\n"; 117 | } 118 | 119 | unless (open C, '<', $filename) { 120 | warn "cannot open script $display_filename for reading: $!\n"; 121 | $status |= 2; 122 | next; 123 | } 124 | 125 | $issues = 0; 126 | $mode = 0; 127 | my $cat_string = ""; 128 | my $cat_indented = 0; 129 | my $quote_string = ""; 130 | my $last_continued = 0; 131 | my $continued = 0; 132 | my $found_rules = 0; 133 | my $buffered_orig_line = ""; 134 | my $buffered_line = ""; 135 | my %start_lines; 136 | 137 | while () { 138 | next unless ($check_lines_count == -1 or $. <= $check_lines_count); 139 | 140 | if ($. == 1) { # This should be an interpreter line 141 | if (m,^\#!\s*(\S+),) { 142 | my $interpreter = $1; 143 | 144 | if ($interpreter =~ m,/make$,) { 145 | init_hashes if !$makefile++; 146 | $makefile = 1; 147 | } else { 148 | init_hashes if $makefile--; 149 | $makefile = 0; 150 | } 151 | next if $opt_force; 152 | 153 | if ($interpreter =~ m,/bash$,) { 154 | $mode = 1; 155 | } 156 | elsif ($interpreter !~ m,/(sh|posh)$,) { 157 | ### ksh/zsh? 158 | warn "script $display_filename does not appear to be a /bin/sh script; skipping\n"; 159 | $status |= 2; 160 | last; 161 | } 162 | } else { 163 | warn "script $display_filename does not appear to have a \#! interpreter line;\nyou may get strange results\n"; 164 | } 165 | } 166 | 167 | chomp; 168 | my $orig_line = $_; 169 | 170 | # We want to remove end-of-line comments, so need to skip 171 | # comments that appear inside balanced pairs 172 | # of single or double quotes 173 | 174 | # Remove comments in the "quoted" part of a line that starts 175 | # in a quoted block? The problem is that we have no idea 176 | # whether the program interpreting the block treats the 177 | # quote character as part of the comment or as a quote 178 | # terminator. We err on the side of caution and assume it 179 | # will be treated as part of the comment. 180 | # s/^(?:.*?[^\\])?$quote_string(.*)$/$1/ if $quote_string ne ""; 181 | 182 | # skip comment lines 183 | if (m,^\s*\#, && $quote_string eq '' && $buffered_line eq '' && $cat_string eq '') { 184 | next; 185 | } 186 | 187 | # Remove quoted strings so we can more easily ignore comments 188 | # inside them 189 | s/(^|[^\\](?:\\\\)*)\'(?:\\.|[^\\\'])+\'/$1''/g; 190 | s/(^|[^\\](?:\\\\)*)\"(?:\\.|[^\\\"])+\"/$1""/g; 191 | 192 | # If inside a quoted string, remove everything before the quote 193 | s/^.+?\'// 194 | if ($quote_string eq "'"); 195 | s/^.+?[^\\]\"// 196 | if ($quote_string eq '"'); 197 | 198 | # If the remaining string contains what looks like a comment, 199 | # eat it. In either case, swap the unmodified script line 200 | # back in for processing. 201 | if (m/(?:^|[^[\\])[\s\&;\(\)](\#.*$)/) { 202 | $_ = $orig_line; 203 | s/\Q$1\E//; # eat comments 204 | } else { 205 | $_ = $orig_line; 206 | } 207 | 208 | # Handle line continuation 209 | if (!$makefile && $cat_string eq '' && m/\\$/) { 210 | chop; 211 | $buffered_line .= $_; 212 | $buffered_orig_line .= $orig_line . "\n"; 213 | next; 214 | } 215 | 216 | if ($buffered_line ne '') { 217 | $_ = $buffered_line . $_; 218 | $orig_line = $buffered_orig_line . $orig_line; 219 | $buffered_line =''; 220 | $buffered_orig_line =''; 221 | } 222 | 223 | if ($makefile) { 224 | $last_continued = $continued; 225 | if (/[^\\]\\$/) { 226 | $continued = 1; 227 | } else { 228 | $continued = 0; 229 | } 230 | 231 | # Don't match lines that look like a rule if we're in a 232 | # continuation line before the start of the rules 233 | if (/^[\w%-]+:+\s.*?;?(.*)$/ and !($last_continued and !$found_rules)) { 234 | $found_rules = 1; 235 | $_ = $1 if $1; 236 | } 237 | 238 | last if m%^\s*(override\s|export\s)?\s*SHELL\s*:?=\s*(/bin/)?bash\s*%; 239 | 240 | # Remove "simple" target names 241 | s/^[\w%.-]+(?:\s+[\w%.-]+)*::?//; 242 | s/^\t//; 243 | s/(?|<|;|\Z)/o 360 | and m/$LEADIN(\.\s+[^\s;\`:]+\s+([^\s;]+))/o) { 361 | if ($2 =~ /^(\&|\||\d?>|<)/) { 362 | # everything is ok 363 | ; 364 | } else { 365 | $found = 1; 366 | $match = $1; 367 | $explanation = "sourced script with arguments"; 368 | output_explanation($display_filename, $orig_line, $explanation); 369 | } 370 | } 371 | 372 | # Remove "quoted quotes". They're likely to be inside 373 | # another pair of quotes; we're not interested in 374 | # them for their own sake and removing them makes finding 375 | # the limits of the outer pair far easier. 376 | $line =~ s/(^|[^\\\'\"])\"\'\"/$1/g; 377 | $line =~ s/(^|[^\\\'\"])\'\"\'/$1/g; 378 | 379 | foreach my $re (@singlequote_bashisms_keys) { 380 | my $expl = $singlequote_bashisms{$re}; 381 | if ($line =~ m/($re)/) { 382 | $found = 1; 383 | $match = $1; 384 | $explanation = $expl; 385 | output_explanation($display_filename, $orig_line, $explanation); 386 | } 387 | } 388 | 389 | my $re='(?); 394 | } 395 | } 396 | 397 | # $cat_line contains the version of the line we'll check 398 | # for heredoc delimiters later. Initially, remove any 399 | # spaces between << and the delimiter to make the following 400 | # updates to $cat_line easier. However, don't remove the 401 | # spaces if the delimiter starts with a -, as that changes 402 | # how the delimiter is searched. 403 | my $cat_line = $line; 404 | $cat_line =~ s/(<\<-?)\s+(?!-)/$1/g; 405 | 406 | # Ignore anything inside single quotes; it could be an 407 | # argument to grep or the like. 408 | $line =~ s/(^|[^\\\"](?:\\\\)*)\'(?:\\.|[^\\\'])+\'/$1''/g; 409 | 410 | # As above, with the exception that we don't remove the string 411 | # if the quote is immediately preceded by a < or a -, so we 412 | # can match "foo <<-?'xyz'" as a heredoc later 413 | # The check is a little more greedy than we'd like, but the 414 | # heredoc test itself will weed out any false positives 415 | $cat_line =~ s/(^|[^<\\\"-](?:\\\\)*)\'(?:\\.|[^\\\'])+\'/$1''/g; 416 | 417 | $re='(?); 422 | } 423 | } 424 | 425 | foreach my $re (@string_bashisms_keys) { 426 | my $expl = $string_bashisms{$re}; 427 | if ($line =~ m/($re)/) { 428 | $found = 1; 429 | $match = $1; 430 | $explanation = $expl; 431 | output_explanation($display_filename, $orig_line, $explanation); 432 | } 433 | } 434 | 435 | # We've checked for all the things we still want to notice in 436 | # double-quoted strings, so now remove those strings as well. 437 | $line =~ s/(^|[^\\\'](?:\\\\)*)\"(?:\\.|[^\\\"])+\"/$1""/g; 438 | $cat_line =~ s/(^|[^<\\\'-](?:\\\\)*)\"(?:\\.|[^\\\"])+\"/$1""/g; 439 | foreach my $re (@bashisms_keys) { 440 | my $expl = $bashisms{$re}; 441 | if ($line =~ m/($re)/) { 442 | $found = 1; 443 | $match = $1; 444 | $explanation = $expl; 445 | output_explanation($display_filename, $orig_line, $explanation); 446 | } 447 | } 448 | # This check requires the value to be compared, which could 449 | # be done in the regex itself but requires "use re 'eval'". 450 | # So it's better done in its own 451 | if ($line =~ m/$LEADIN((?:exit|return)\s+(\d{3,}))/o && $2 > 255) { 452 | $explanation = 'exit|return status code greater than 255'; 453 | output_explanation($display_filename, $orig_line, $explanation); 454 | } 455 | 456 | # Only look for the beginning of a heredoc here, after we've 457 | # stripped out quoted material, to avoid false positives. 458 | if ($cat_line =~ m/(?:^|[^<])\<\<(\-?)\s*(?:(?!<|'|")((?:[^\s;>|]+(?:(?<=\\)[\s;>|])?)+)|[\'\"](.*?)[\'\"])/) { 459 | $cat_indented = ($1 && $1 eq '-')? 1 : 0; 460 | my $quoted = defined($3); 461 | $cat_string = $quoted? $3 : $2; 462 | unless ($quoted) { 463 | # Now strip backslashes. Keep the position of the 464 | # last match in a variable, as s/// resets it back 465 | # to undef, but we don't want that. 466 | my $pos = 0; 467 | pos($cat_string) = $pos; 468 | while ($cat_string =~ s/\G(.*?)\\/$1/) { 469 | # postition += length of match + the character 470 | # that followed the backslash: 471 | $pos += length($1)+1; 472 | pos($cat_string) = $pos; 473 | } 474 | } 475 | $start_lines{'cat_string'} = $.; 476 | } 477 | } 478 | } 479 | 480 | warn "error: $display_filename: Unterminated heredoc found, EOF reached. Wanted: <$cat_string>, opened in line $start_lines{'cat_string'}\n" 481 | if ($cat_string ne ''); 482 | warn "error: $display_filename: Unterminated quoted string found, EOF reached. Wanted: <$quote_string>, opened in line $start_lines{'quote_string'}\n" 483 | if ($quote_string ne ''); 484 | warn "error: $display_filename: EOF reached while on line continuation.\n" 485 | if ($buffered_line ne ''); 486 | 487 | close C; 488 | 489 | if ($mode && !$issues) { 490 | warn "could not find any possible bashisms in bash script $filename\n"; 491 | $status |= 4; 492 | } 493 | } 494 | 495 | exit $status; 496 | 497 | sub output_explanation { 498 | my ($filename, $line, $explanation) = @_; 499 | 500 | if ($mode) { 501 | # When examining a bash script, just flag that there are indeed 502 | # bashisms present 503 | $issues = 1; 504 | } else { 505 | warn "possible bashism in $filename line $. ($explanation):\n$line\n"; 506 | $status |= 1; 507 | } 508 | } 509 | 510 | # Returns non-zero if the given file is not actually a shell script, 511 | # just looks like one. 512 | sub script_is_evil_and_wrong { 513 | my ($filename) = @_; 514 | my $ret = -1; 515 | # lintian's version of this function aborts if the file 516 | # can't be opened, but we simply return as the next 517 | # test in the calling code handles reporting the error 518 | # itself 519 | open (IN, '<', $filename) or return $ret; 520 | my $i = 0; 521 | my $var = "0"; 522 | my $backgrounded = 0; 523 | local $_; 524 | while () { 525 | chomp; 526 | next if /^#/o; 527 | next if /^$/o; 528 | last if (++$i > 55); 529 | if (m~ 530 | # the exec should either be "eval"ed or a new statement 531 | (^\s*|\beval\s*[\'\"]|(;|&&|\b(then|else))\s*) 532 | 533 | # eat anything between the exec and $0 534 | exec\s*.+\s* 535 | 536 | # optionally quoted executable name (via $0) 537 | .?\$$var.?\s* 538 | 539 | # optional "end of options" indicator 540 | (--\s*)? 541 | 542 | # Match expressions of the form '${1+$@}', '${1:+"$@"', 543 | # '"${1+$@', "$@", etc where the quotes (before the dollar 544 | # sign(s)) are optional and the second (or only if the $1 545 | # clause is omitted) parameter may be $@ or $*. 546 | # 547 | # Finally the whole subexpression may be omitted for scripts 548 | # which do not pass on their parameters (i.e. after re-execing 549 | # they take their parameters (and potentially data) from stdin 550 | .?(\${1:?\+.?)?(\$(\@|\*))?~x) { 551 | $ret = $. - 1; 552 | last; 553 | } elsif (/^\s*(\w+)=\$0;/) { 554 | $var = $1; 555 | } elsif (m~ 556 | # Match scripts which use "foo $0 $@ &\nexec true\n" 557 | # Program name 558 | \S+\s+ 559 | 560 | # As above 561 | .?\$$var.?\s* 562 | (--\s*)? 563 | .?(\${1:?\+.?)?(\$(\@|\*))?.?\s*\&~x) { 564 | 565 | $backgrounded = 1; 566 | } elsif ($backgrounded and m~ 567 | # the exec should either be "eval"ed or a new statement 568 | (^\s*|\beval\s*[\'\"]|(;|&&|\b(then|else))\s*) 569 | exec\s+true(\s|\Z)~x) { 570 | 571 | $ret = $. - 1; 572 | last; 573 | } elsif (m~\@DPATCH\@~) { 574 | $ret = $. - 1; 575 | last; 576 | } 577 | 578 | } 579 | close IN; 580 | return $ret; 581 | } 582 | 583 | sub init_hashes { 584 | 585 | %bashisms = ( 586 | qr'(?:^|\s+)function [^<>\(\)\[\]\{\};|\s]+(\s|\(|\Z)' => q<'function' is useless>, 587 | $LEADIN . qr'select\s+\w+' => q<'select' is not POSIX>, 588 | qr'(test|-o|-a)\s*[^\s]+\s+==\s' => q, 589 | qr'\[\s+[^\]]+\s+==\s' => q, 590 | qr'\s\|\&' => q, 591 | qr'[^\\\$]\{([^\s\\\}]*?,)+[^\\\}\s]*\}' => q, 592 | qr'\{\d+\.\.\d+(?:\.\.\d+)?\}' => q, 593 | qr'(?i)\{[a-z]\.\.[a-z](?:\.\.\d+)?\}' => q, 594 | qr'(?:^|\s+)\w+\[\d+\]=' => q, 595 | $LEADIN . qr'read\s+(?:-[a-qs-zA-Z\d-]+)' => q, 596 | $LEADIN . qr'read\s*(?:-\w+\s*)*(?:\".*?\"|[\'].*?[\'])?\s*(?:;|$)' 597 | => q, 598 | $LEADIN . qr'echo\s+(-n\s+)?-n?en?\s' => q, 599 | $LEADIN . qr'exec\s+-[acl]' => q, 600 | $LEADIN . qr'let\s' => q, 601 | qr'(? q<'((' should be '$(('>, 602 | qr'(?:^|\s+)(\[|test)\s+-a' => q, 603 | qr'\&>' => qword 2\>&1>, 604 | qr'(<\&|>\&)\s*((-|\d+)[^\s;|)}`&\\\\]|[^-\d\s]+(? 605 | qword 2\>&1>, 606 | qr'\[\[(?!:)' => q, 607 | qr'/dev/(tcp|udp)' => q, 608 | $LEADIN . qr'builtin\s' => q, 609 | $LEADIN . qr'caller\s' => q, 610 | $LEADIN . qr'compgen\s' => q, 611 | $LEADIN . qr'complete\s' => q, 612 | $LEADIN . qr'declare\s' => q, 613 | $LEADIN . qr'dirs(\s|\Z)' => q, 614 | $LEADIN . qr'disown\s' => q, 615 | $LEADIN . qr'enable\s' => q, 616 | $LEADIN . qr'mapfile\s' => q, 617 | $LEADIN . qr'readarray\s' => q, 618 | $LEADIN . qr'shopt(\s|\Z)' => q, 619 | $LEADIN . qr'suspend\s' => q, 620 | $LEADIN . qr'time\s' => q