Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-20 16:48:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix some Shellecheck issues

Browse Source 
Fix Shellcheck issues SC2171, SC2236, SC2269, SC2320, SC2321, and SC2322.
This commit is contained in:
David Cooper
2026-09-17 17:51:40 -07:00
committed by David
parent 080a656f18
commit 3cf9b6596c
1 changed files with 23 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testssl.sh
+23 -24
View File
@@ -2156,7 +2156,7 @@ check_revocation_ocsp() {
[[ $DEBUG -ge 3 ]] && echo "Switching to $openssl_bin "
ossl_ver="$($openssl_bin version -v 2>/dev/null)"
ossl_name="${ossl_ver%% *}"
ossl_ver="${ossl_ver#$ossl_name }"
ossl_ver="${ossl_ver#"$ossl_name" }"
ossl_ver="${ossl_ver%% *}"
ossl_ver_major="${ossl_ver%%\.*}"
fi
@@ -2180,7 +2180,7 @@ check_revocation_ocsp() {
if [[ $success -eq 0 ]] && grep -Fq "Response verify OK" "$tmpfile"; then
response="$(grep -F "$HOSTCERT: " "$tmpfile")"
response="${response#$HOSTCERT: }"
response="${response#"$HOSTCERT": }"
response="${response%\.}"
if [[ "$response" =~ good ]]; then
out ", "
@@ -3665,7 +3665,7 @@ run_security_headers() {
# Include $header when determining where to insert line breaks, but print $header
# separately.
header_output="$(out_row_aligned_max_width "${header:2}: $HEADERVALUE" "$spaces " $TERM_WIDTH)"
outln "${header_output#${header:2}}"
outln "${header_output#"${header:2}"}"
fileout "$header" "$svrty" "$HEADERVALUE"
fi
done
@@ -7924,7 +7924,7 @@ cipher_pref_check() {
done
if [[ -n "$first_cipher" ]]; then
# Search for first ChaCha20 cipher that comes after $first_cipher in $order.
for first_chacha_cipher in ${order#*$first_cipher}; do
for first_chacha_cipher in ${order#*"$first_cipher"}; do
[[ "$first_chacha_cipher" =~ CHACHA20 ]] && break
done
fi
@@ -8510,7 +8510,7 @@ extract_stapled_ocsp() {
ocsp="${response##*TLS server extension \"status request\" (id=5), len=}"
ocsp="${ocsp%%<<<*}"
tmp="${ocsp%%[!0-9]*}"
ocsp="${ocsp#$tmp}"
ocsp="${ocsp#"$tmp"}"
ocsp_len=$((2*tmp))
ocsp="$(awk ' { print $3 $4 $5 $6 $7 $8 $9 $10 $11 $12 $13 $14 $15 $16 $17 } ' <<< "$ocsp" | sed 's/-//')"
ocsp="$(strip_spaces "$(newline_to_spaces "$ocsp")")"
@@ -8759,7 +8759,7 @@ get_cn_from_cert() {
# see x509(1ssl):
subject="$($OPENSSL x509 -in $1 -noout -subject -nameopt multiline,-align,sname,-esc_msb,utf8,-space_eq 2>>$ERRFILE)"
echo "$(awk -F'=' '/CN=/ { print $2 }' <<< "$subject" | tr '\n' ' ')"
return $?
return 0
}
# Return 0 if the name provided in arg1 is a wildcard name
@@ -9384,14 +9384,14 @@ determine_dates_certificate() {
d=$(( ${yearend:8:2} - ${yearstart:8:2} ))
# We take the year, month, days here as old OpenBSD's date is too difficult for real conversion
# see comment in parse_date(). In diffseconds then we have the estimated absolute validity period
diffseconds=$(( d + ((m*30)) + ((y*365)) ))
diffseconds=$(( d + (m*30) + (y*365) ))
diffseconds=$((diffseconds * secsaday))
# Now we estimate the days left plus length of month/year:
yearnow="$(date -juz GMT "+%Y-%m-%d %H:%M")"
y=$(( ${yearend:0:4} - ${yearnow:0:4} ))
m=$(( ${yearend:5:1} - ${yearnow:5:1} + ${yearend:6:1} - ${yearnow:6:1} ))
d=$(( ${yearend:8:2} - ${yearnow:8:2} ))
days2expire=$(( d + ((m*30)) + ((y*365)) ))
days2expire=$(( d + (m*30) + (y*365) ))
else
startdate="$(parse_date "$startdate" +"%F %H:%M" "%b %d %T %Y %Z")"
enddate="$(parse_date "$enddate" +"%F %H:%M" "%b %d %T %Y %Z")"
@@ -10481,7 +10481,7 @@ certificate_info() {
[[ "$intermediates" =~ \-\-\-\-\-BEGIN\ CERTIFICATE\-\-\-\-\- ]] || break
intermediates="${intermediates#*-----BEGIN CERTIFICATE-----}"
cert="${intermediates%%-----END CERTIFICATE-----*}"
intermediates="${intermediates#${cert}-----END CERTIFICATE-----}"
intermediates="${intermediates#"${cert}"-----END CERTIFICATE-----}"
cert="-----BEGIN CERTIFICATE-----${cert}-----END CERTIFICATE-----"
fileout "intermediate_cert <#${i}>${json_postfix}" "INFO" "$(pem_to_one_line "$cert")"
@@ -11231,7 +11231,7 @@ run_fs() {
if [[ "$(count_words "$OSSL_SUPPORTED_CURVES")" -gt 28 ]]; then
# Place the first 28 supported curves in curves_list1 and the remainder in curves_list2.
curves_list2="${curves_list1#* * * * * * * * * * * * * * * * * * * * * * * * * * * * }"
curves_list1="${curves_list1%$curves_list2}"
curves_list1="${curves_list1%"$curves_list2"}"
curves_list1="$(strip_trailing_space "$curves_list1")"
curves_list2="${curves_list2// /:}"
fi
@@ -11943,7 +11943,7 @@ run_npn() {
if "$HAS_NPN"; then
# TLS 1.3 s_client doesn't support -nextprotoneg when connecting with TLS 1.3. So we need to make sure it won't be used
# TLS13_ONLY is tested here again, just to be sure, see npn_pre
if "$HAS_TLS13" && ! $TLS13_ONLY ]] ; then
if "$HAS_TLS13" && ! "$TLS13_ONLY"; then
proto="-no_tls1_3"
fi
$OPENSSL s_client $(s_client_options "$proto -connect $NODEIP:$PORT $BUGS $SNI -nextprotoneg "$NPN_PROTOs"") </dev/null 2>$ERRFILE >$TMPFILE
@@ -14325,8 +14325,8 @@ gcm() {
vh=${gcm_ctx_hh[i]}
vl=${gcm_ctx_hl[i]}
for (( j=1; j < i; j++ )); do
gcm_ctx_hh[$((i+j))]=$((vh ^ gcm_ctx_hh[j]))
gcm_ctx_hl[$((i+j))]=$((vl ^ gcm_ctx_hl[j]))
gcm_ctx_hh[i+j]=$((vh ^ gcm_ctx_hh[j]))
gcm_ctx_hl[i+j]=$((vl ^ gcm_ctx_hl[j]))
done
done
@@ -14465,7 +14465,7 @@ gcm-decrypt() {
tmp="$(gcm "$cipher" "$key" "$nonce" "$ciphertext" "$aad" "decrypt" "$compute_tag")"
[[ $? -ne 0 ]] && return 7
computed_tag="${tmp##* }"
plaintext="${tmp% $computed_tag}"
plaintext="${tmp% "$computed_tag"}"
if ! "$compute_tag" || [[ "$computed_tag" == $expected_tag ]]; then
if [[ -n "$plaintext" ]]; then
@@ -18441,7 +18441,7 @@ run_crime() {
fileout "$jsonID" "OK" "not vulnerable" "$cve" "$cwe"
fi
else
if [[ $SERVICE == HTTP ]] || [[ "$CLIENT_AUTH" == required ]] || [[ ! -z "$MTLS" ]]; then
if [[ $SERVICE == HTTP ]] || [[ "$CLIENT_AUTH" == required ]] || [[ -n "$MTLS" ]]; then
pr_svrty_high "VULNERABLE (NOT ok)"
fileout "$jsonID" "HIGH" "VULNERABLE" "$cve" "$cwe" "$hint"
else
@@ -21317,10 +21317,10 @@ find_openssl_binary() {
OSSL_VER=$(awk -F' ' '{ print $2 }' <<< "${ossl_line1}")
OSSL_VER_MAJOR="${OSSL_VER%%\.*}"
OSSL_VER_MINOR="${OSSL_VER%%-*}"
OSSL_VER_MINOR="${OSSL_VER_MINOR#$OSSL_VER_MAJOR\.}"
OSSL_VER_MINOR="${OSSL_VER_MINOR#"$OSSL_VER_MAJOR"\.}"
OSSL_VER_MINOR="${OSSL_VER_MINOR%%[a-zA-Z]*}"
# like -bad -fips etc:
OSSL_VER_APPENDIX="${OSSL_VER#$OSSL_VER_MAJOR\.$OSSL_VER_MINOR}"
OSSL_VER_APPENDIX="${OSSL_VER#"$OSSL_VER_MAJOR"\."$OSSL_VER_MINOR"}"
OSSL_VER_PLATFORM="$(awk '/^platform: / { print $2 }' < $TEMPDIR/openssl_version_all)"
OSSL_BUILD_DATE="$(awk '/^built on/' < $TEMPDIR/openssl_version_all)"
OSSL_BUILD_DATE=${OSSL_BUILD_DATE#*: }
@@ -21332,7 +21332,7 @@ find_openssl_binary() {
# the year, remove it until the end and then re-add just the year
for yr in {2014..2029} ; do
if [[ $OSSL_SHORT_STR =~ \ $yr ]] ; then
OSSL_SHORT_STR=${OSSL_SHORT_STR%%$yr*}
OSSL_SHORT_STR=${OSSL_SHORT_STR%%"$yr"*}
OSSL_SHORT_STR="${OSSL_SHORT_STR}${yr}"
break
fi
@@ -21374,7 +21374,7 @@ find_openssl_binary() {
if [[ "$openssl_location" == ${PWD}/bin ]]; then
OPENSSL_LOCATION="\$PWD/bin/$(basename "$openssl_location")"
elif [[ "$openssl_location" =~ $cwd ]] && [[ "$cwd" != '.' ]]; then
OPENSSL_LOCATION="${openssl_location%%$cwd}"
OPENSSL_LOCATION="${openssl_location%%"$cwd"}"
else
OPENSSL_LOCATION="$openssl_location"
fi
@@ -22929,7 +22929,7 @@ decode_https_rr_alpn() {
while (( ptr < len )); do
[[ -n "$alpn_str" ]] && alpn_str+="," # add a comma in the >=2 round
alpn_len=${entry:$ptr:2}
alpn_len=$(( ((10#$alpn_len)) * 2 )) # also make sure it's a number
alpn_len=$(( (10#$alpn_len) * 2 )) # also make sure it's a number
ptr=$((ptr + 2)) # len field is always 2 bytes
alpn_wire=${entry:$ptr:$alpn_len}
@@ -22972,7 +22972,7 @@ decode_https_rr_ipv4() {
# after address 18, 16, ... we need a comma
if [[ $len -ne $((ptr + 2)) ]]; then
if [[ $(( ((ptr + 2 )) % 8 )) -eq 0 ]] ; then
if [[ $(( (ptr + 2 ) % 8 )) -eq 0 ]] ; then
ipv4_str+=","
else
ipv4_str+="."
@@ -23028,7 +23028,7 @@ decode_https_rr_ipv6() {
ipv6_str+="$ipv6_wire"
if [[ $len -ne $((ptr + 4)) ]]; then
if [[ $(( ((ptr + 4)) % 32 )) -eq 0 ]]; then # we have two bytes pointer 30+2=32
if [[ $(( (ptr + 4) % 32 )) -eq 0 ]]; then # we have two bytes pointer 30+2=32
ipv6_str+=","
else
ipv6_str+=":"
@@ -25880,11 +25880,10 @@ parse_cmd_line() {
done
# Check if mTLS has been selected, and if the correct client auth PEM file has been provided by user
if [[ ! -z "$MTLS" ]]; then
if [[ -n "$MTLS" ]]; then
if [[ -f $MTLS ]]; then
grep -q 'BEGIN CERTIFICATE' "$MTLS" || fatal_cmd_line "\"$MTLS\" is not a client certificate file in PEM format" $ERR_RESOURCE
grep -Eaq 'BEGIN PRIVATE KEY|BEGIN RSA PRIVATE KEY|BEGIN EC PRIVATE KEY' "$MTLS" || fatal_cmd_line "\"$MTLS\" the not encrypted private key is missing in the specified PEM file" $ERR_RESOURCE
MTLS=$MTLS
else
[[ -s "$MTLS" ]] || fatal_cmd_line "the specified client certificate file \"$MTLS\" does not exist" $ERR_RESOURCE
fi