Warn about sed pattern variable expansion with unescaped forward shashes

[karolinepauls]

For new checks and feature suggestions

• [ v ] shellcheck.net (i.e. the latest commit) currently gives no useful warnings about this
• [ v ] I searched through https://github.com/koalaman/shellcheck/issues and didn't find anything related

Here's a snippet or screenshot that shows the problem:

#!/bin/bash
AAA='AAA/AAA'
sed "s/12/$AAA/"

Here's what shellcheck currently says:

No issues detected!

Here's what I wanted or expected to see:

Line 3:
sed "s/12/$AAA/"
^-- SCXXXX: Variable expansion in sed patterns should escape forward slashes, like: "${VARIABLE//\//\\/}"; ignore if variable is already escaped.

Not all shells can use character substitution when expanding variables.

It may be hard to detect if forward slashes are escaped correctly but it's easy to detect they're not escaped at all.

False positives: without the "ignore if variable is already escaped" clause, if the string is already escaped, we risk suggesting to double-escape it. However, if it contains no slashes, escaping them won't change anything.

There may be better ways to escape forward slashes.