working with external commands and files and --

[deknos]

Hi,
when shellscripts call external tools like mv, rm, touch, cp -- should be used, if your tool could check this, that would be great!
This is no bash, thingie, but sometimes an issue and could prevent bugs :)

Thanks for your work!

[sayoder]

Hi @deknos, any chance you could expand on this?
Are you suggesting that one should use -- with every invocation of an external program, and that ShellCheck should throw a warning if the double dash is not used?

[koalaman]

There's currently SC2035 for e.g. ls *.png but not more generally for things like ls "$var"

[Dirk-Herrmann]

Hi and thanks for this great tool!
The "perfect" solution would issue SC2035 (or a related warning) in call cases where expansions could unintentionally produce "arguments looking like options". However, sometimes variable expansion to arguments is not unintentional, like using some variable like $verbosity to configure script verbosity. In such cases, to avoid too many false positives, variable expansion between other options should not be flagged. Example: rm $verbosity -r <args> should not lead to a warning, also rm $verbosity -- <args>, however, rm $verbosity <args> should be flagged, because here ShellCheck can not deduce whether expansion to options would be intentional or not. Also, rm somefile $var should be flagged, because rm even accepts options after file arguments.
Kind regards

[guillaume-d]

The problem is that to always be relevant that rule would require knowing which external commands effectively support --.
Maybe all GNU commands and other GNU-getopt-based ones do, but shellcheck probably cannot be expected to test or know these implementation details.

Also this rule should probably be optional, because in my experience it would trigger a lot of violations on mundane, real-world code (not necessarily a bad thing for security though 😏...).

[guillaume-d]

Also #2305 is a duplicate which however has a few interesting links about the security implications.