{"action":"created","issue":{"url":"https://api.github.com/repos/icy/pacapt/issues/54","labels_url":"https://api.github.com/repos/icy/pacapt/issues/54/labels{/name}","comments_url":"https://api.github.com/repos/icy/pacapt/issues/54/comments","events_url":"https://api.github.com/repos/icy/pacapt/issues/54/events","html_url":"https://github.com/icy/pacapt/issues/54","id":95833262,"number":54,"title":"Must we  create an enforcement for quoting variable?","user":{"login":"Gnouc","id":4304764,"avatar_url":"https://avatars.githubusercontent.com/u/4304764?v=3","gravatar_id":"","url":"https://api.github.com/users/Gnouc","html_url":"https://github.com/Gnouc","followers_url":"https://api.github.com/users/Gnouc/followers","following_url":"https://api.github.com/users/Gnouc/following{/other_user}","gists_url":"https://api.github.com/users/Gnouc/gists{/gist_id}","starred_url":"https://api.github.com/users/Gnouc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gnouc/subscriptions","organizations_url":"https://api.github.com/users/Gnouc/orgs","repos_url":"https://api.github.com/users/Gnouc/repos","events_url":"https://api.github.com/users/Gnouc/events{/privacy}","received_events_url":"https://api.github.com/users/Gnouc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/icy/pacapt/labels/Security","name":"Security","color":"009800"}],"state":"open","locked":false,"assignee":{"login":"icy","id":75696,"avatar_url":"https://avatars.githubusercontent.com/u/75696?v=3","gravatar_id":"","url":"https://api.github.com/users/icy","html_url":"https://github.com/icy","followers_url":"https://api.github.com/users/icy/followers","following_url":"https://api.github.com/users/icy/following{/other_user}","gists_url":"https://api.github.com/users/icy/gists{/gist_id}","starred_url":"https://api.github.com/users/icy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/icy/subscriptions","organizations_url":"https://api.github.com/users/icy/orgs","repos_url":"https://api.github.com/users/icy/repos","events_url":"https://api.github.com/users/icy/events{/privacy}","received_events_url":"https://api.github.com/users/icy/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-07-18T15:28:42Z","updated_at":"2015-07-22T10:56:15Z","closed_at":null,"body":"As previous describing in [this issue](https://github.com/icy/pacapt/issues/40), forgetting to quote variables in shell script leading to many security implications.\r\n\r\nExample in `compile.sh` line `95` -> `99`:\r\n\r\n```\r\nfor L in ./lib/*.sh; do\r\n  [[ \"${L##*/}\" != \"zz_main.sh\" ]] \\\r\n  || continue\r\n\r\n  $GREP -v '^#' $L\r\ndone\r\n```\r\n\r\nthis can be easily fooled by creating a file `* *.sh` in `./lib`, causing the content of all lib files printed twice. It's just a simple case, there can be many hidden weird behaviors that we can not cover, like code injection.\r\n\r\nIs it time to make an enforcement for contributors to quote all the variables?"},"comment":{"url":"https://api.github.com/repos/icy/pacapt/issues/comments/123664041","html_url":"https://github.com/icy/pacapt/issues/54#issuecomment-123664041","issue_url":"https://api.github.com/repos/icy/pacapt/issues/54","id":123664041,"user":{"login":"Gnouc","id":4304764,"avatar_url":"https://avatars.githubusercontent.com/u/4304764?v=3","gravatar_id":"","url":"https://api.github.com/users/Gnouc","html_url":"https://github.com/Gnouc","followers_url":"https://api.github.com/users/Gnouc/followers","following_url":"https://api.github.com/users/Gnouc/following{/other_user}","gists_url":"https://api.github.com/users/Gnouc/gists{/gist_id}","starred_url":"https://api.github.com/users/Gnouc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gnouc/subscriptions","organizations_url":"https://api.github.com/users/Gnouc/orgs","repos_url":"https://api.github.com/users/Gnouc/repos","events_url":"https://api.github.com/users/Gnouc/events{/privacy}","received_events_url":"https://api.github.com/users/Gnouc/received_events","type":"User","site_admin":false},"created_at":"2015-07-22T10:56:15Z","updated_at":"2015-07-22T10:56:15Z","body":"@NgoHuy: It's only a workaround, and require you to change your code structure.\r\n\r\nGenerally, if you don't want to use `shellcheck`, or you have trouble with typing many double quotes, you have to:\r\n\r\n - Setting `IFS` to consistent value\r\n - Using `set -f` to disable globbing and `set +f` to enable when wanting it\r\n\r\nBut I think it will lead to more works than simply always double quotes variables."}}