ShellCheck - A shell script static analysis tool

Table of Contents

How to use

On the web

From your terminal

In your editor

In your build or test suites

check-scripts:# Fail if any of these files have warnings    shellcheck myscripts/*.sh

script:# Fail if any of these files have warnings  -shellcheck myscripts/*.sh

Installing

cabal updatecabal install ShellCheck

stack updatestack install ShellCheck

sudo apt install shellcheck

pacman -S shellcheck

emerge --ask shellcheck

sudo yum -y install epel-releasesudo yum install ShellCheck

dnf install ShellCheck

pkg install hs-ShellCheck

brew install shellcheck

sudo port install shellcheck

pkg_add shellcheck

zypper in ShellCheck

eopkg install shellcheck

C:\> choco install shellcheck

C:\> scoop install shellcheck

conda install -c conda-forge shellcheck

snap install --channel=edge shellcheck

docker run --rm -v"$PWD:/mnt" koalaman/shellcheck:stable myscript# Or :v0.4.7 for that version, or :latest for daily builds

nix-env -iA nixpkgs.shellcheck

pandoc -s -f markdown-smart -t man shellcheck.1.md -o shellcheck.1sudo mv shellcheck.1 /usr/share/man/man1

pre-commit

repos:-   repo: https://github.com/koalaman/shellcheck-precommit    rev: v0.7.2    hooks:    -   id: shellcheck#       args: ["--severity=warning"]  # Optionally only show errors and warnings

Travis CI

Installing a pre-compiled binary

scversion="stable"# or "v0.4.7", or "latest"wget -qO-"https://github.com/koalaman/shellcheck/releases/download/${scversion?}/shellcheck-${scversion?}.linux.x86_64.tar.xz"| tar -xJvcp"shellcheck-${scversion}/shellcheck" /usr/bin/shellcheck --version

Compiling from source

Installing Cabal

$ brew install cabal-install

$ cabal update

Compiling ShellCheck

$ cabal install

$ cabal install --enable-tests

export PATH="$HOME/.cabal/bin:$PATH"

$ which shellcheck~/.cabal/bin/shellcheck

chcp65001

[Console]::OutputEncoding= [System.Text.Encoding]::UTF8

Running tests

$ cabal test

Gallery of bad code

Quoting

echo$1# Unquoted variablesfind. -name*.ogg# Unquoted find/grep patternsrm"~/my file.txt"# Quoted tilde expansionv='--verbose="true"'; cmd$v# Literal quotes in variablesforfin"*.ogg"# Incorrectly quoted 'for' loopstouch$@# Unquoted $@echo'Don't forget to restart!'   # Singlequote closed by apostropheecho'Don\'t try this at home'    # Attempting to escape'in''echo'Path is $PATH'# Variables in single quotestrap"echo Took${SECONDS}s" 0# Prematurely expanded trapunset var[i]# Array index treated as glob

Conditionals

[[ n!= 0 ]]# Constant test expressions[[-e*.mpg ]]# Existence checks of globs[[$foo==0 ]]# Always true due to missing spaces[[-n"$foo" ]]# Always true due to literals[[$foo=~"fo+" ]]# Quoted regex in =~[ foo=~ re ]# Unsupported [ ] operators[$1-eq"shellcheck" ]# Numerical comparison of strings[$n&&$m ]# && in [ .. ][ grep -q foo file ]# Command without $(..)[["$$file"==*.jpg ]]# Comparisons that can't succeed((1-lt2))# Using test operators in ((..))[ x ]& [ y ]| [ z ]# Accidental backgrounding and piping

Frequently misused commands

grep'*foo*' file# Globs in regex contextsfind. -exec foo {}&& bar {}\;# Prematurely terminated find -execsudoecho'Var=42'> /etc/profile# Redirecting sudotime --format=%s sleep 10# Passing time(1) flags to time builtinwhileread h;do ssh"$h" uptime# Commands eating while loop inputalias archive='mv $1 /backup'# Defining aliases with argumentstr -cd'[a-zA-Z0-9]'# [] around ranges in trexec foo;echo"Done!"# Misused 'exec'find -name\*.bak -o -name\*~ -delete# Implicit precedence in find# find . -exec foo > bar \;       # Redirections in findf() { whoami; }; sudo f# External use of internal functions

Common beginner's mistakes

var = 42# Spaces around = in assignments$foo=42# $ in assignmentsfor$varin*;do ...# $ in for loop variablesvar$n="Hello"# Wrong indirect assignmentecho${var$n}# Wrong indirect referencevar=(1, 2, 3)# Comma separated arraysarray=( [index] = value )# Incorrect index initializationecho$var[14]# Missing {} in array referencesecho"Argument 10 is$10"# Positional parameter misreferenceif$(myfunction);then ..;fi# Wrapping commands in $()elseif othercondition;then ..# Using 'else if'f;f() {echo"hello world; }     # Using function before definition[ false ]                         # 'false' being trueif ( -f file )                    # Using (..) instead of test

Style

[[-z$(find /tmp| grep mpg) ]]# Use grep -q insteada>> log; b>> log; c>> log# Use a redirection block insteadecho"The time is`date`"# Use $() insteadcd dir; process*;cd ..;# Use subshells insteadecho $[1+2]# Use standard $((..)) instead of old $[]echo$(($RANDOM%6))# Don't use $ on variables in $((..))echo"$(date)"# Useless use of echocat file| grep foo# Useless use of cat

Data and typing errors

args="$@"# Assigning arrays to stringsfiles=(foo bar);echo"$files"# Referencing arrays as stringsdeclare -A arr=(foo bar)# Associative arrays without indexprintf"%s\n""Arguments:$@."# Concatenating strings and arrays[[$#> 2 ]]# Comparing numbers as stringsvar=World;echo"Hello" var# Unused lowercase variablesecho"Hello$name"# Unassigned lowercase variablescmd|read bar;echo$bar# Assignments in subshellscat foo| cp bar# Piping to commands that don't readprintf'%s: %s\n' foo# Mismatches in printf argument counteval"${array[@]}"# Lost word boundaries in array evalforiin"${x[@]}";do${x[$i]}# Using array value as key

Robustness

rm -rf"$STEAMROOT/"*# Catastrophic rmtouch ./-l; ls*# Globs that could become optionsfind. -exec sh -c'a && b {}'\;# Find -exec shell injectionprintf"Hello$name"# Variables in printf formatforfin$(ls*.txt);do# Iterating over ls outputexport MYVAR=$(cmd)# Masked exit codescase$versionin 2.*):;; 2.6.*)# Shadowed case branches

Portability

echo {1..$n}# Works in ksh, but not bash/dash/shecho {1..10}# Works in ksh and bash, but not dash/shecho -n 42# Works in ksh, bash and dash, undefined in shexpr match str regex# Unportable alias for `expr str : regex`trap'exit 42' sigint# Unportable signal speccmd&> file# Unportable redirection operatorread foo< /dev/tcp/host/22# Unportable intercepted filesfoo-bar() { ..; }# Undefined/unsupported function name[$UID= 0 ]# Variable undefined in dash/shlocal var=value# local is undefined in shtime sleep 1| sleep 5# Undefined uses of 'time'

Miscellaneous

PS1='\e[0;32m\$\e[0m'# PS1 colors not in \[..\]PATH="$PATH:~/bin"# Literal tilde in $PATHrm “file”# Unicode quotesecho"Hello world"# Carriage return / DOS line endingsecho hello\# Trailing spaces after \var=42echo$var# Expansion of inlined environment!# bin/bash -x -e                 # Common shebang errorsecho$((n/180*100))# Unnecessary loss of precisionls*[:digit:].txt# Bad character class globssed's/foo/bar/' file> file# Redirecting to inputvar2=$var2# Variable assigned to itself[ x$var= xval ]# Antiquated x-comparisonsls() { ls -l"$@"; }# Infinitely recursive wrapperalias ls='ls -l'; ls foo# Alias used before it takes effectfor x;dofor x;do# Nested loop uses same variablewhilegetopts"a" f;docase$fin"b")# Unhandled getopts flags

Testimonials

Ignoring issues

Reporting bugs

Contributing

Copyright

Other Resources