{"action":"created","issue":{"url":"https://api.github.com/repos/icy/pacapt/issues/54","labels_url":"https://api.github.com/repos/icy/pacapt/issues/54/labels{/name}","comments_url":"https://api.github.com/repos/icy/pacapt/issues/54/comments","events_url":"https://api.github.com/repos/icy/pacapt/issues/54/events","html_url":"https://github.com/icy/pacapt/issues/54","id":95833262,"number":54,"title":"Must we  create an enforcement for quoting variable?","user":{"login":"Gnouc","id":4304764,"avatar_url":"https://avatars.githubusercontent.com/u/4304764?v=3","gravatar_id":"","url":"https://api.github.com/users/Gnouc","html_url":"https://github.com/Gnouc","followers_url":"https://api.github.com/users/Gnouc/followers","following_url":"https://api.github.com/users/Gnouc/following{/other_user}","gists_url":"https://api.github.com/users/Gnouc/gists{/gist_id}","starred_url":"https://api.github.com/users/Gnouc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gnouc/subscriptions","organizations_url":"https://api.github.com/users/Gnouc/orgs","repos_url":"https://api.github.com/users/Gnouc/repos","events_url":"https://api.github.com/users/Gnouc/events{/privacy}","received_events_url":"https://api.github.com/users/Gnouc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/icy/pacapt/labels/Security","name":"Security","color":"009800"}],"state":"open","locked":false,"assignee":{"login":"icy","id":75696,"avatar_url":"https://avatars.githubusercontent.com/u/75696?v=3","gravatar_id":"","url":"https://api.github.com/users/icy","html_url":"https://github.com/icy","followers_url":"https://api.github.com/users/icy/followers","following_url":"https://api.github.com/users/icy/following{/other_user}","gists_url":"https://api.github.com/users/icy/gists{/gist_id}","starred_url":"https://api.github.com/users/icy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/icy/subscriptions","organizations_url":"https://api.github.com/users/icy/orgs","repos_url":"https://api.github.com/users/icy/repos","events_url":"https://api.github.com/users/icy/events{/privacy}","received_events_url":"https://api.github.com/users/icy/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2015-07-18T15:28:42Z","updated_at":"2015-07-20T04:48:42Z","closed_at":null,"body":"As previous describing in [this issue](https://github.com/icy/pacapt/issues/40), forgetting to quote variables in shell script leading to many security implications.\r\n\r\nExample in `compile.sh` line `95` -> `99`:\r\n\r\n```\r\nfor L in ./lib/*.sh; do\r\n  [[ \"${L##*/}\" != \"zz_main.sh\" ]] \\\r\n  || continue\r\n\r\n  $GREP -v '^#' $L\r\ndone\r\n```\r\n\r\nthis can be easily fooled by creating a file `* *.sh` in `./lib`, causing the content of all lib files printed twice. It's just a simple case, there can be many hidden weird behaviors that we can not cover, like code injection.\r\n\r\nIs it time to make an enforcement for contributors to quote all the variables?"},"comment":{"url":"https://api.github.com/repos/icy/pacapt/issues/comments/122761377","html_url":"https://github.com/icy/pacapt/issues/54#issuecomment-122761377","issue_url":"https://api.github.com/repos/icy/pacapt/issues/54","id":122761377,"user":{"login":"Gnouc","id":4304764,"avatar_url":"https://avatars.githubusercontent.com/u/4304764?v=3","gravatar_id":"","url":"https://api.github.com/users/Gnouc","html_url":"https://github.com/Gnouc","followers_url":"https://api.github.com/users/Gnouc/followers","following_url":"https://api.github.com/users/Gnouc/following{/other_user}","gists_url":"https://api.github.com/users/Gnouc/gists{/gist_id}","starred_url":"https://api.github.com/users/Gnouc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gnouc/subscriptions","organizations_url":"https://api.github.com/users/Gnouc/orgs","repos_url":"https://api.github.com/users/Gnouc/repos","events_url":"https://api.github.com/users/Gnouc/events{/privacy}","received_events_url":"https://api.github.com/users/Gnouc/received_events","type":"User","site_admin":false},"created_at":"2015-07-20T04:48:42Z","updated_at":"2015-07-20T04:48:42Z","body":"@icy: We can use [shellcheck](http://www.shellcheck.net/) to make a checking before pull request, every pull without passing shellcheck will be denied.\r\n\r\nAbout my example. It's more about internal usage by our developer. In the real world, everyone on system which hold `pacapt` source code and have the write access to the `pacapt` source directory can be do that trick.\r\n\r\nI shown the example only for pointing out a possible case. There can be others that we can not coverage.\r\n\r\nAnd actually, it can make `pacapt` run a litter faster because don't quote variable actually called `split+glob` operator."}}