From 0c16ebd6b9af1af62849d16e2c6c43c27036529b Mon Sep 17 00:00:00 2001 From: Dirk Date: Fri, 10 Jul 2026 19:33:08 +0200 Subject: [PATCH 1/6] Small check for semantic check Staring with a simple pattern for checking for non-variables at left hand side like [[ LHS == $value ]]. The file is supposed be amended in the future. This fixes #3074 . Upon commit it fails first as there are two instances which will be detected (one is deliberate but will be changed too) . --- t/03_syntax_check.t | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100755 t/03_syntax_check.t diff --git a/t/03_syntax_check.t b/t/03_syntax_check.t new file mode 100755 index 0000000..07dca9c --- /dev/null +++ b/t/03_syntax_check.t @@ -0,0 +1,29 @@ +#!/usr/bin/env perl + +# Basics: are there semantic errors which are easy to spot? + +use strict; +use Test::More; + +my $tests = 0; +my $prg="testssl.sh"; +# Patterns used to trigger an error: + +#1 +printf "\n%s\n", "Testing for missing vars at left hand side in double square brackets ..."; + +# I know this isn't nice but perl doesn't seem for this so great either +my @matches = `grep -n '\\[\\[ [[:alpha:]]' $prg`; +is(scalar(@matches), 0, "Checking bad '[[ LHS' patterns") + or diag(@matches); +$tests++; +i + +# more would go here + +printf "\n"; +done_testing($tests); + + +# vim:ts=5:sw=5:expandtab + From 27c432e95deaa6b7b6bbbbe760c355a907eb9aad Mon Sep 17 00:00:00 2001 From: Dirk Date: Fri, 10 Jul 2026 20:20:38 +0200 Subject: [PATCH 2/6] Add more checks recommended by Claude Sonnet 5 The backtick pattern will fail in a comment. To be fixed later --- t/03_syntax_check.t | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/t/03_syntax_check.t b/t/03_syntax_check.t index 07dca9c..f1e95f6 100755 --- a/t/03_syntax_check.t +++ b/t/03_syntax_check.t @@ -7,7 +7,9 @@ use Test::More; my $tests = 0; my $prg="testssl.sh"; -# Patterns used to trigger an error: +my $os="$^O"; + + #1 printf "\n%s\n", "Testing for missing vars at left hand side in double square brackets ..."; @@ -17,7 +19,36 @@ my @matches = `grep -n '\\[\\[ [[:alpha:]]' $prg`; is(scalar(@matches), 0, "Checking bad '[[ LHS' patterns") or diag(@matches); $tests++; -i + +#2 +printf "\n%s\n", "Testing for backticks ..."; + +my @matches = qx(grep -nP '`[^`]*`' $prg); +is(scalar(@matches), 0, "Checking bad backtick patterns") +or diag(@matches); +$tests++; + +#3 +printf "\n%s\n", "Sourcing without checking the file exists #1 ..."; + +my @matches = qx(grep -nP '^\s*\.\s+\$' $prg); +is(scalar(@matches), 0, "Checking bad sourcing pattern #1") +or diag(@matches); +$tests++; + +#4 +printf "\n%s\n", "Sourcing without checking the file exists #2 ..."; + +my @matches = qx(grep -nP '^\s*source\s+\$' $prg); +is(scalar(@matches), 0, "Checking bad sourcing pattern #2") +or diag(@matches); +$tests++; + + +# We have three eval already, a) re-analyse + exempt them +#my @matches = qx(grep -nP '\beval\b' $prg); + + # more would go here From 49c26b7e3654a66921dd471cfa3512b1b4306eba Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Fri, 10 Jul 2026 22:25:49 +0200 Subject: [PATCH 3/6] perl-style grep for mac so skip the while thing --- t/03_syntax_check.t | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/t/03_syntax_check.t b/t/03_syntax_check.t index f1e95f6..6bad130 100755 --- a/t/03_syntax_check.t +++ b/t/03_syntax_check.t @@ -9,7 +9,10 @@ my $tests = 0; my $prg="testssl.sh"; my $os="$^O"; - +if ( $os eq "darwin" ){ + printf "%s\n", "Skipping checks"; + exit 0; +} #1 printf "\n%s\n", "Testing for missing vars at left hand side in double square brackets ..."; @@ -20,6 +23,7 @@ is(scalar(@matches), 0, "Checking bad '[[ LHS' patterns") or diag(@matches); $tests++; + #2 printf "\n%s\n", "Testing for backticks ..."; From 20a632844b2d029f4101d3a8cd4df4ecc12f9f74 Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Sat, 11 Jul 2026 15:35:21 +0200 Subject: [PATCH 4/6] Now fix the existing non-compliant issues 18422: if [[ $tmp_result -eq 1 ]] && [[ loop_reneg -eq 1 ]]; then 19633: [[ aaa == bbb ]] # provoke return code=1 450:TRUSTED1ST="" # Contains the `-trusted_first` flag, if this version of openssl supports it The latter check be amended/corrected later, so that backticks in comments are allowed. --- testssl.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/testssl.sh b/testssl.sh index fa167e9..8c3f369 100755 --- a/testssl.sh +++ b/testssl.sh @@ -447,7 +447,7 @@ KEY_EXCH_SCORE=100 # Keeps track of the score for category CIPH_STR_BEST=0 # Keeps track of the best bit size for category 3 "Cipher Strength" CIPH_STR_WORST=100000 # Keeps track of the worst bit size for category 3 "Cipher Strength" # Intentionally set very high, so it can be set to 0, if necessary -TRUSTED1ST="" # Contains the `-trusted_first` flag, if this version of openssl supports it +TRUSTED1ST="" # Contains the "-trusted_first" flag, if this version of openssl supports it ########### Global variables for parallel mass testing # @@ -18419,7 +18419,7 @@ run_renego() { tmp_result=2 rm -f $TEMPDIR/was_killed fi - if [[ $tmp_result -eq 1 ]] && [[ loop_reneg -eq 1 ]]; then + if [[ $tmp_result -eq 1 ]] && [[ $loop_reneg -eq 1 ]]; then tmp_result=3 fi if [[ $SERVICE != HTTP ]]; then @@ -19630,7 +19630,7 @@ run_drown() { if [[ $(has_server_protocol ssl2) -ne 1 ]]; then sslv2_sockets else - [[ aaa == bbb ]] # provoke return code=1 + false fi case $? in From ed07c763e17feb87f0fe4ea82e5c23e708f2f135 Mon Sep 17 00:00:00 2001 From: Dirk Date: Sat, 11 Jul 2026 17:12:50 +0200 Subject: [PATCH 5/6] Check on MacOS returned not ok --- t/03_syntax_check.t | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/t/03_syntax_check.t b/t/03_syntax_check.t index 6bad130..5b7a75c 100755 --- a/t/03_syntax_check.t +++ b/t/03_syntax_check.t @@ -10,8 +10,9 @@ my $prg="testssl.sh"; my $os="$^O"; if ( $os eq "darwin" ){ - printf "%s\n", "Skipping checks"; - exit 0; + printf "%s\n", "Skipping checks on MacOS"; + printf "\n"; + done_testing($tests); } #1 @@ -23,6 +24,7 @@ is(scalar(@matches), 0, "Checking bad '[[ LHS' patterns") or diag(@matches); $tests++; +# The following works only on GNU grep #2 printf "\n%s\n", "Testing for backticks ..."; @@ -53,7 +55,6 @@ $tests++; #my @matches = qx(grep -nP '\beval\b' $prg); - # more would go here printf "\n"; From f6a59dc0836994be7bfd9dc1e97a4b363954224a Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Sat, 11 Jul 2026 19:03:05 +0200 Subject: [PATCH 6/6] Properly premature exit for MacOS --- t/03_syntax_check.t | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/t/03_syntax_check.t b/t/03_syntax_check.t index 5b7a75c..cf27689 100755 --- a/t/03_syntax_check.t +++ b/t/03_syntax_check.t @@ -10,9 +10,7 @@ my $prg="testssl.sh"; my $os="$^O"; if ( $os eq "darwin" ){ - printf "%s\n", "Skipping checks on MacOS"; - printf "\n"; - done_testing($tests); + plan skip_all => 'No checks on MacOS'; } #1