From 3cf9b6596cd8acd5aab8313a7bddf2c709ffb103 Mon Sep 17 00:00:00 2001 From: David Cooper Date: Wed, 16 Sep 2026 09:40:09 -0700 Subject: [PATCH] Fix some Shellecheck issues Fix Shellcheck issues SC2171, SC2236, SC2269, SC2320, SC2321, and SC2322. --- testssl.sh | 47 +++++++++++++++++++++++------------------------ 1 file changed, 23 insertions(+), 24 deletions(-) diff --git a/testssl.sh b/testssl.sh index dbfecad..982e040 100755 --- a/testssl.sh +++ b/testssl.sh @@ -2156,7 +2156,7 @@ check_revocation_ocsp() { [[ $DEBUG -ge 3 ]] && echo "Switching to $openssl_bin " ossl_ver="$($openssl_bin version -v 2>/dev/null)" ossl_name="${ossl_ver%% *}" - ossl_ver="${ossl_ver#$ossl_name }" + ossl_ver="${ossl_ver#"$ossl_name" }" ossl_ver="${ossl_ver%% *}" ossl_ver_major="${ossl_ver%%\.*}" fi @@ -2180,7 +2180,7 @@ check_revocation_ocsp() { if [[ $success -eq 0 ]] && grep -Fq "Response verify OK" "$tmpfile"; then response="$(grep -F "$HOSTCERT: " "$tmpfile")" - response="${response#$HOSTCERT: }" + response="${response#"$HOSTCERT": }" response="${response%\.}" if [[ "$response" =~ good ]]; then out ", " @@ -3665,7 +3665,7 @@ run_security_headers() { # Include $header when determining where to insert line breaks, but print $header # separately. header_output="$(out_row_aligned_max_width "${header:2}: $HEADERVALUE" "$spaces " $TERM_WIDTH)" - outln "${header_output#${header:2}}" + outln "${header_output#"${header:2}"}" fileout "$header" "$svrty" "$HEADERVALUE" fi done @@ -7924,7 +7924,7 @@ cipher_pref_check() { done if [[ -n "$first_cipher" ]]; then # Search for first ChaCha20 cipher that comes after $first_cipher in $order. - for first_chacha_cipher in ${order#*$first_cipher}; do + for first_chacha_cipher in ${order#*"$first_cipher"}; do [[ "$first_chacha_cipher" =~ CHACHA20 ]] && break done fi @@ -8510,7 +8510,7 @@ extract_stapled_ocsp() { ocsp="${response##*TLS server extension \"status request\" (id=5), len=}" ocsp="${ocsp%%<<<*}" tmp="${ocsp%%[!0-9]*}" - ocsp="${ocsp#$tmp}" + ocsp="${ocsp#"$tmp"}" ocsp_len=$((2*tmp)) ocsp="$(awk ' { print $3 $4 $5 $6 $7 $8 $9 $10 $11 $12 $13 $14 $15 $16 $17 } ' <<< "$ocsp" | sed 's/-//')" ocsp="$(strip_spaces "$(newline_to_spaces "$ocsp")")" @@ -8759,7 +8759,7 @@ get_cn_from_cert() { # see x509(1ssl): subject="$($OPENSSL x509 -in $1 -noout -subject -nameopt multiline,-align,sname,-esc_msb,utf8,-space_eq 2>>$ERRFILE)" echo "$(awk -F'=' '/CN=/ { print $2 }' <<< "$subject" | tr '\n' ' ')" - return $? + return 0 } # Return 0 if the name provided in arg1 is a wildcard name @@ -9384,14 +9384,14 @@ determine_dates_certificate() { d=$(( ${yearend:8:2} - ${yearstart:8:2} )) # We take the year, month, days here as old OpenBSD's date is too difficult for real conversion # see comment in parse_date(). In diffseconds then we have the estimated absolute validity period - diffseconds=$(( d + ((m*30)) + ((y*365)) )) + diffseconds=$(( d + (m*30) + (y*365) )) diffseconds=$((diffseconds * secsaday)) # Now we estimate the days left plus length of month/year: yearnow="$(date -juz GMT "+%Y-%m-%d %H:%M")" y=$(( ${yearend:0:4} - ${yearnow:0:4} )) m=$(( ${yearend:5:1} - ${yearnow:5:1} + ${yearend:6:1} - ${yearnow:6:1} )) d=$(( ${yearend:8:2} - ${yearnow:8:2} )) - days2expire=$(( d + ((m*30)) + ((y*365)) )) + days2expire=$(( d + (m*30) + (y*365) )) else startdate="$(parse_date "$startdate" +"%F %H:%M" "%b %d %T %Y %Z")" enddate="$(parse_date "$enddate" +"%F %H:%M" "%b %d %T %Y %Z")" @@ -10481,7 +10481,7 @@ certificate_info() { [[ "$intermediates" =~ \-\-\-\-\-BEGIN\ CERTIFICATE\-\-\-\-\- ]] || break intermediates="${intermediates#*-----BEGIN CERTIFICATE-----}" cert="${intermediates%%-----END CERTIFICATE-----*}" - intermediates="${intermediates#${cert}-----END CERTIFICATE-----}" + intermediates="${intermediates#"${cert}"-----END CERTIFICATE-----}" cert="-----BEGIN CERTIFICATE-----${cert}-----END CERTIFICATE-----" fileout "intermediate_cert <#${i}>${json_postfix}" "INFO" "$(pem_to_one_line "$cert")" @@ -11231,7 +11231,7 @@ run_fs() { if [[ "$(count_words "$OSSL_SUPPORTED_CURVES")" -gt 28 ]]; then # Place the first 28 supported curves in curves_list1 and the remainder in curves_list2. curves_list2="${curves_list1#* * * * * * * * * * * * * * * * * * * * * * * * * * * * }" - curves_list1="${curves_list1%$curves_list2}" + curves_list1="${curves_list1%"$curves_list2"}" curves_list1="$(strip_trailing_space "$curves_list1")" curves_list2="${curves_list2// /:}" fi @@ -11943,7 +11943,7 @@ run_npn() { if "$HAS_NPN"; then # TLS 1.3 s_client doesn't support -nextprotoneg when connecting with TLS 1.3. So we need to make sure it won't be used # TLS13_ONLY is tested here again, just to be sure, see npn_pre - if "$HAS_TLS13" && ! $TLS13_ONLY ]] ; then + if "$HAS_TLS13" && ! "$TLS13_ONLY"; then proto="-no_tls1_3" fi $OPENSSL s_client $(s_client_options "$proto -connect $NODEIP:$PORT $BUGS $SNI -nextprotoneg "$NPN_PROTOs"") $ERRFILE >$TMPFILE @@ -14325,8 +14325,8 @@ gcm() { vh=${gcm_ctx_hh[i]} vl=${gcm_ctx_hl[i]} for (( j=1; j < i; j++ )); do - gcm_ctx_hh[$((i+j))]=$((vh ^ gcm_ctx_hh[j])) - gcm_ctx_hl[$((i+j))]=$((vl ^ gcm_ctx_hl[j])) + gcm_ctx_hh[i+j]=$((vh ^ gcm_ctx_hh[j])) + gcm_ctx_hl[i+j]=$((vl ^ gcm_ctx_hl[j])) done done @@ -14465,7 +14465,7 @@ gcm-decrypt() { tmp="$(gcm "$cipher" "$key" "$nonce" "$ciphertext" "$aad" "decrypt" "$compute_tag")" [[ $? -ne 0 ]] && return 7 computed_tag="${tmp##* }" - plaintext="${tmp% $computed_tag}" + plaintext="${tmp% "$computed_tag"}" if ! "$compute_tag" || [[ "$computed_tag" == $expected_tag ]]; then if [[ -n "$plaintext" ]]; then @@ -18441,7 +18441,7 @@ run_crime() { fileout "$jsonID" "OK" "not vulnerable" "$cve" "$cwe" fi else - if [[ $SERVICE == HTTP ]] || [[ "$CLIENT_AUTH" == required ]] || [[ ! -z "$MTLS" ]]; then + if [[ $SERVICE == HTTP ]] || [[ "$CLIENT_AUTH" == required ]] || [[ -n "$MTLS" ]]; then pr_svrty_high "VULNERABLE (NOT ok)" fileout "$jsonID" "HIGH" "VULNERABLE" "$cve" "$cwe" "$hint" else @@ -21317,10 +21317,10 @@ find_openssl_binary() { OSSL_VER=$(awk -F' ' '{ print $2 }' <<< "${ossl_line1}") OSSL_VER_MAJOR="${OSSL_VER%%\.*}" OSSL_VER_MINOR="${OSSL_VER%%-*}" - OSSL_VER_MINOR="${OSSL_VER_MINOR#$OSSL_VER_MAJOR\.}" + OSSL_VER_MINOR="${OSSL_VER_MINOR#"$OSSL_VER_MAJOR"\.}" OSSL_VER_MINOR="${OSSL_VER_MINOR%%[a-zA-Z]*}" # like -bad -fips etc: - OSSL_VER_APPENDIX="${OSSL_VER#$OSSL_VER_MAJOR\.$OSSL_VER_MINOR}" + OSSL_VER_APPENDIX="${OSSL_VER#"$OSSL_VER_MAJOR"\."$OSSL_VER_MINOR"}" OSSL_VER_PLATFORM="$(awk '/^platform: / { print $2 }' < $TEMPDIR/openssl_version_all)" OSSL_BUILD_DATE="$(awk '/^built on/' < $TEMPDIR/openssl_version_all)" OSSL_BUILD_DATE=${OSSL_BUILD_DATE#*: } @@ -21332,7 +21332,7 @@ find_openssl_binary() { # the year, remove it until the end and then re-add just the year for yr in {2014..2029} ; do if [[ $OSSL_SHORT_STR =~ \ $yr ]] ; then - OSSL_SHORT_STR=${OSSL_SHORT_STR%%$yr*} + OSSL_SHORT_STR=${OSSL_SHORT_STR%%"$yr"*} OSSL_SHORT_STR="${OSSL_SHORT_STR}${yr}" break fi @@ -21374,7 +21374,7 @@ find_openssl_binary() { if [[ "$openssl_location" == ${PWD}/bin ]]; then OPENSSL_LOCATION="\$PWD/bin/$(basename "$openssl_location")" elif [[ "$openssl_location" =~ $cwd ]] && [[ "$cwd" != '.' ]]; then - OPENSSL_LOCATION="${openssl_location%%$cwd}" + OPENSSL_LOCATION="${openssl_location%%"$cwd"}" else OPENSSL_LOCATION="$openssl_location" fi @@ -22929,7 +22929,7 @@ decode_https_rr_alpn() { while (( ptr < len )); do [[ -n "$alpn_str" ]] && alpn_str+="," # add a comma in the >=2 round alpn_len=${entry:$ptr:2} - alpn_len=$(( ((10#$alpn_len)) * 2 )) # also make sure it's a number + alpn_len=$(( (10#$alpn_len) * 2 )) # also make sure it's a number ptr=$((ptr + 2)) # len field is always 2 bytes alpn_wire=${entry:$ptr:$alpn_len} @@ -22972,7 +22972,7 @@ decode_https_rr_ipv4() { # after address 18, 16, ... we need a comma if [[ $len -ne $((ptr + 2)) ]]; then - if [[ $(( ((ptr + 2 )) % 8 )) -eq 0 ]] ; then + if [[ $(( (ptr + 2 ) % 8 )) -eq 0 ]] ; then ipv4_str+="," else ipv4_str+="." @@ -23028,7 +23028,7 @@ decode_https_rr_ipv6() { ipv6_str+="$ipv6_wire" if [[ $len -ne $((ptr + 4)) ]]; then - if [[ $(( ((ptr + 4)) % 32 )) -eq 0 ]]; then # we have two bytes pointer 30+2=32 + if [[ $(( (ptr + 4) % 32 )) -eq 0 ]]; then # we have two bytes pointer 30+2=32 ipv6_str+="," else ipv6_str+=":" @@ -25880,11 +25880,10 @@ parse_cmd_line() { done # Check if mTLS has been selected, and if the correct client auth PEM file has been provided by user - if [[ ! -z "$MTLS" ]]; then + if [[ -n "$MTLS" ]]; then if [[ -f $MTLS ]]; then grep -q 'BEGIN CERTIFICATE' "$MTLS" || fatal_cmd_line "\"$MTLS\" is not a client certificate file in PEM format" $ERR_RESOURCE grep -Eaq 'BEGIN PRIVATE KEY|BEGIN RSA PRIVATE KEY|BEGIN EC PRIVATE KEY' "$MTLS" || fatal_cmd_line "\"$MTLS\" the not encrypted private key is missing in the specified PEM file" $ERR_RESOURCE - MTLS=$MTLS else [[ -s "$MTLS" ]] || fatal_cmd_line "the specified client certificate file \"$MTLS\" does not exist" $ERR_RESOURCE fi