Skip to content

Commit 08ed552

Browse files
drwetterdrwetter
authored
Merge pull request #2922 from testssl/shellcheck1
Squash some shellcheck *errors*
2 parents 8bc2185 + c53e7a3 commit 08ed552

1 file changed

Lines changed: 42 additions & 40 deletions

File tree

‎testssl.sh‎

Lines changed: 42 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,16 @@
1111
# Stable version https://testssl.sh
1212
# File bugs at GitHub https://github.com/testssl/testssl.sh/issues
1313
#
14-
# Project lead and initiator: Dirk Wetter, copyleft: 2007-today, contributions so far see CREDITS.md
15-
# Main contributions from David Cooper
16-
# Project lead and initiator: Dirk Wetter, copyleft: 2007-today.
14+
# Project lead and initiator: Dirk Wetter, copyleft: 2007-today, contributions so far
15+
# see CREDITS.md .
1716
# Main contributions from David Cooper. Further contributors see CREDITS.md .
1817
#
19-
# License: GPLv2, see https://opensource.org/licenses/gpl-2.0.php and
20-
# accompanying license "LICENSE.txt". Redistribution + modification under this
21-
# license permitted.
18+
# License: GPLv2, see https://opensource.org/licenses/gpl-2.0.php and accompanying
19+
# license "LICENSE.txt". Redistribution + modification under this license permitted.
20+
#
2221
# If you enclose this program or parts of it in your software, it has to be
2322
# accompanied by the same license (see link). Do not violate the license.
24-
# If you do not agree to these terms, do not use it in the first place!
23+
# If you do not agree to these terms, do not use testssl.sh in the first place!
2524
#
2625
# OpenSSL, which is being used and maybe distributed via one of this projects'
2726
# web sites, is subject to their licensing: https://www.openssl.org/source/license.txt
@@ -30,18 +29,19 @@
3029
# Terms of Use' (v2.2), see https://www.ssllabs.com/downloads/Qualys_SSL_Labs_Terms_of_Use.pdf,
3130
# stating a CC BY 3.0 US license: https://creativecommons.org/licenses/by/3.0/us/
3231
#
33-
# Please note: USAGE WITHOUT ANY WARRANTY, THE SOFTWARE IS PROVIDED "AS IS".
34-
# USE IT AT your OWN RISK!
35-
# Seriously! The threat is you run this code on your computer and untrusted input e.g.
36-
# could be supplied from a server you are querying.
32+
# Please note:
33+
# USAGE WITHOUT ANY WARRANTY, THE SOFTWARE IS PROVIDED "AS IS". USE IT AT your OWN RISK!
34+
#
35+
# The threat is you run this code on your computer and untrusted input could be supplied from
36+
# a server you are testing.
3737
#
3838
# HISTORY:
3939
# Back in 2006 it all started with a few openssl commands...
4040
# That's because openssl is a such a good swiss army knife (see e.g.
4141
# https://wiki.openssl.org/index.php/Command_Line_Utilities) that it was difficult to resist
4242
# wrapping some shell commands around it, which I used for my pen tests. This is how
4343
# everything started.
44-
# Now it has grown up, it has bash socket support for most features, which has been basically
44+
# Testssl.sh has grown up, it has bash socket support for most features, which has been basically
4545
# replacing more and more functions of OpenSSL and some sockets functions serve as some kind
4646
# of central functions.
4747
#
@@ -89,7 +89,7 @@ declare -r ALLOK=0 # All is fine
8989

9090

9191
[ -z "${BASH_VERSINFO[0]}" ] && printf "\n\033[1;35m Please make sure you're using \"bash\"! Bye...\033[m\n\n" >&2 && exit $ERR_BASH
92-
[ $(kill -l | grep -c SIG) -eq 0 ] && printf "\n\033[1;35m Please make sure you're calling me without leading \"sh\"! Bye...\033[m\n\n" >&2 && exit $ERR_BASH
92+
if ! kill -l | grep -q SIG ; then printf "\n\033[1;35m Please make sure you're calling me not as \"/bin/sh\"! Bye...\033[m\n\n" >&2 ; exit $ERR_BASH; fi
9393
[ ${BASH_VERSINFO[0]} -lt 3 ] && printf "\n\033[1;35m Minimum requirement is bash 3.2. You have $BASH_VERSION \033[m\n\n" >&2 && exit $ERR_BASH
9494
[ ${BASH_VERSINFO[0]} -le 3 ] && [ ${BASH_VERSINFO[1]} -le 1 ] && printf "\n\033[1;35m Minimum requirement is bash 3.2. You have $BASH_VERSION \033[m\n\n" >&2 && exit $ERR_BASH
9595

@@ -123,6 +123,7 @@ trap "child_error" USR1
123123
########### Internal definitions
124124
#
125125
declare -r VERSION="3.3dev"
126+
# shellcheck disable=SC2034
126127
declare -r SWCONTACT="dirk aet testssl dot sh"
127128
[[ "$VERSION" =~ dev|rc|beta ]] && \
128129
SWURL="https://testssl.sh/dev/" ||
@@ -461,6 +462,7 @@ declare TLS_CIPHER_OSSL_NAME=()
461462
declare TLS_CIPHER_RFC_NAME=()
462463
declare TLS_CIPHER_SSLVERS=()
463464
declare TLS_CIPHER_KX=()
465+
# shellcheck disable=SC2034 . This is a false positive
464466
declare TLS_CIPHER_AUTH=()
465467
declare TLS_CIPHER_ENC=()
466468
declare TLS_CIPHER_EXPORT=()
@@ -2499,13 +2501,13 @@ service_detection() {
24992501
send_app_data "$plaintext"
25002502
if [[ $? -eq 0 ]]; then
25012503
receive_app_data true
2502-
[[ $? -eq 0 ]] || > "$TMPFILE"
2504+
[[ $? -eq 0 ]] || : > "$TMPFILE"
25032505
else
2504-
> "$TMPFILE"
2506+
: > "$TMPFILE"
25052507
fi
25062508
send_close_notify "$DETECTED_TLS_VERSION"
25072509
else
2508-
> "$TMPFILE"
2510+
: > "$TMPFILE"
25092511
fi
25102512
else
25112513
# SNI is not standardized for !HTTPS but fortunately for other protocols s_client doesn't seem to care
@@ -2920,7 +2922,7 @@ run_hsts() {
29202922
fi
29212923
debugme echo "hsts_age_sec: $hsts_age_sec"
29222924
if ! is_number "$hsts_age_sec"; then
2923-
pr_svrty_medium "misconfiguration: \'"$hsts_age_sec"\' is not a valid max-age specification"
2925+
pr_svrty_medium "misconfiguration: \'$hsts_age_sec\' is not a valid max-age specification"
29242926
fileout "${jsonID}_time" "MEDIUM" "misconfiguration, specified not a number for max-age"
29252927
set_grade_warning "HSTS max-age is misconfigured"
29262928
else
@@ -3638,7 +3640,7 @@ normalize_ciphercode() {
36383640

36393641
prettyprint_local() {
36403642
local arg line
3641-
local hexc hexcode dash ciph sslvers kx auth enc mac export
3643+
local hexc hexcode dash ciph sslvers kx auth enc mac exprt
36423644
local re='^[0-9A-Fa-f]+$'
36433645

36443646
if [[ "$1" == 0x* ]] || [[ "$1" == 0X* ]]; then
@@ -3658,19 +3660,19 @@ prettyprint_local() {
36583660
neat_header
36593661

36603662
if [[ -z "$1" ]]; then
3661-
while read -r hexcode dash ciph sslvers kx auth enc mac export ; do
3663+
while read -r hexcode dash ciph sslvers kx auth enc mac exprt ; do
36623664
hexc="$(normalize_ciphercode $hexcode)"
3663-
outln "$(neat_list "$hexc" "$ciph" "$kx" "$enc" "$export")"
3665+
outln "$(neat_list "$hexc" "$ciph" "$kx" "$enc" "$exprt")"
36643666
done < <(actually_supported_osslciphers 'ALL:COMPLEMENTOFALL:@STRENGTH' 'ALL' "-V") # -V doesn't work with openssl < 1.0
36653667
else
36663668
#for arg in $(echo $@ | sed 's/,/ /g'); do
36673669
for arg in ${*//,/ /}; do
3668-
while read -r hexcode dash ciph sslvers kx auth enc mac export ; do
3670+
while read -r hexcode dash ciph sslvers kx auth enc mac exprt ; do
36693671
hexc="$(normalize_ciphercode $hexcode)"
36703672
# for numbers we don't do word matching:
36713673
[[ $arg =~ $re ]] && \
3672-
line="$(neat_list "$hexc" "$ciph" "$kx" "$enc" "$export" | grep -ai "$arg")" || \
3673-
line="$(neat_list "$hexc" "$ciph" "$kx" "$enc" "$export" | grep -wai "$arg")"
3674+
line="$(neat_list "$hexc" "$ciph" "$kx" "$enc" "$exprt" | grep -ai "$arg")" || \
3675+
line="$(neat_list "$hexc" "$ciph" "$kx" "$enc" "$exprt" | grep -wai "$arg")"
36743676
[[ -n "$line" ]] && outln "$line"
36753677
done < <(actually_supported_osslciphers 'ALL:COMPLEMENTOFALL:@STRENGTH' 'ALL' "-V") # -V doesn't work with openssl < 1.0
36763678
done
@@ -3831,7 +3833,7 @@ neat_header(){
38313833

38323834
neat_list(){
38333835
local hexcode="$1"
3834-
local ossl_cipher="$2" export="$5" tls_cipher=""
3836+
local ossl_cipher="$2" exprt="$5" tls_cipher=""
38353837
local kx enc strength line what_dh bits
38363838
local -i i len
38373839
local how2show="$6"
@@ -3856,7 +3858,7 @@ neat_list(){
38563858
set_ciph_str_score $strength
38573859
fi
38583860

3859-
[[ "$export" =~ export ]] && strength="$strength,exp"
3861+
[[ "$exprt" =~ export ]] && strength="$strength,exp"
38603862

38613863
[[ "$DISPLAY_CIPHERNAMES" != openssl-only ]] && tls_cipher="$(show_rfc_style "$hexcode")"
38623864

@@ -10925,7 +10927,7 @@ run_fs() {
1092510927
local -i sclient_success
1092610928
local fs_offered=false ecdhe_offered=false ffdhe_offered=false
1092710929
local fs_tls13_offered=false fs_tls12_offered=false
10928-
local protos_to_try proto hexc dash fs_cipher sslvers auth mac export curve dhlen
10930+
local protos_to_try proto hexc dash fs_cipher sslvers auth mac exprt curve dhlen
1092910931
local -a hexcode normalized_hexcode ciph rfc_ciph kx enc ciphers_found sigalg ossl_supported
1093010932
# generated from 'kEECDH:kEDH:!aNULL:!eNULL:!DES:!3DES:!RC4' with openssl 1.0.2i and openssl 1.1.0
1093110933
local fs_cipher_list="DHE-DSS-AES128-GCM-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES128-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-DSS-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-CAMELLIA128-SHA256:DHE-DSS-CAMELLIA128-SHA:DHE-DSS-CAMELLIA256-SHA256:DHE-DSS-CAMELLIA256-SHA:DHE-DSS-SEED-SHA:DHE-RSA-AES128-CCM8:DHE-RSA-AES128-CCM:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-CCM8:DHE-RSA-AES256-CCM:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA256:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-CAMELLIA256-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-CHACHA20-POLY1305-OLD:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-SEED-SHA:ECDHE-ECDSA-AES128-CCM8:ECDHE-ECDSA-AES128-CCM:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-CCM8:ECDHE-ECDSA-AES256-CCM:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305-OLD:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-RSA-CAMELLIA128-SHA256:ECDHE-RSA-CAMELLIA256-SHA384:ECDHE-RSA-CHACHA20-POLY1305-OLD:ECDHE-RSA-CHACHA20-POLY1305"
@@ -10998,7 +11000,7 @@ run_fs() {
1099811000
fi
1099911001
done
1100011002
else
11001-
while read -r hexc dash ciph[nr_supported_ciphers] sslvers kx[nr_supported_ciphers] auth enc[nr_supported_ciphers] mac export; do
11003+
while read -r hexc dash ciph[nr_supported_ciphers] sslvers kx[nr_supported_ciphers] auth enc[nr_supported_ciphers] mac exprt; do
1100211004
ciphers_found[nr_supported_ciphers]=false
1100311005
if [[ "${hexc:2:2}" == 00 ]]; then
1100411006
normalized_hexcode[nr_supported_ciphers]="x${hexc:7:2}"
@@ -13134,7 +13136,7 @@ derive-handshake-secret() {
1313413136
pubkeys_and_ciphers="${pubkeys_and_ciphers%--END HYBRID CIPHERTEXT--*}"
1313513137
privkeys="${tmpfile#*---BEGIN HYBRID PRIV KEY---}"
1313613138
privkeys="${privkeys%---END HYBRID PRIV KEY---*}"
13137-
13139+
1313813140
while [[ "$pubkeys_and_ciphers" =~ BEGIN ]]; do
1313913141
if [[ "${pubkeys_and_ciphers:0:27}" =~ BEGIN\ CIPHERTEXT ]]; then
1314013142
key_or_cipher="-----BEGIN CIPHERTEXT${pubkeys_and_ciphers#*-----BEGIN CIPHERTEXT}"
@@ -18360,19 +18362,19 @@ run_breach() {
1836018362

1836118363
# Final verdict (if not happened preemptively before). We reuse $detected_compression here
1836218364
detected_compression=""
18363-
if [[ ${has_compression[@]} =~ warn ]]; then
18365+
if [[ ${has_compression[*]} =~ warn ]]; then
1836418366
# warn_empty / warn_stalled
18365-
if [[ ${has_compression[@]} =~ warn_empty ]]; then
18366-
pr_warning "At least 1/4 checks failed (HTTP header request was empty, debug: ${has_compression[@]}"
18367-
outln ", debug: ${has_compression[@]})"
18368-
fileout "$jsonID" "WARN" "Test failed as HTTP response was empty, debug: ${has_compression[@]}" "$cve" "$cwe"
18367+
if [[ ${has_compression[*]} =~ warn_empty ]]; then
18368+
pr_warning "At least 1/4 checks failed (HTTP header request was empty, debug: ${has_compression[*]}"
18369+
outln ", debug: ${has_compression[*]})"
18370+
fileout "$jsonID" "WARN" "Test failed as HTTP response was empty, debug: ${has_compression[*]}" "$cve" "$cwe"
1836918371
else # warn_stalled
1837018372
pr_warning "At least 1/4 checks failed (HTTP header request stalled and was terminated"
18371-
outln ", debug: ${has_compression[@]})"
18373+
outln ", debug: ${has_compression[*]})"
1837218374
fileout "$jsonID" "WARN" "Test failed as HTTP request stalled and was terminated" "$cve" "$cwe"
1837318375
fi
1837418376
else
18375-
for c in ${has_compression[@]}; do
18377+
for c in ${has_compression[*]}; do
1837618378
if [[ $c =~ yes ]]; then
1837718379
detected_compression+="${c%:*} "
1837818380
fi
@@ -18383,7 +18385,7 @@ run_breach() {
1838318385
outln "${spaces}${when_makesense}"
1838418386
fileout "$jsonID" "MEDIUM" "potentially VULNERABLE, $detected_compression HTTP compression detected $disclaimer" "$cve" "$cwe" "$hint"
1838518387
fi
18386-
debugme outln "${spaces}has_compression: ${has_compression[@]}"
18388+
debugme outln "${spaces}has_compression: ${has_compression[*]}"
1838718389
;;
1838818390
esac
1838918391

@@ -19778,7 +19780,7 @@ run_winshock() {
1977819780
# Check whether there are any TLS extension which should not be available under <= Windows 2012 R2
1977919781
for tls_ext in "${TLS_EXTENSIONS[@]}"; do
1978019782
# We use the whole array, got to be careful when the array becomes bigger (unintended match)
19781-
if [[ ${forbidden_tls_ext[@]} =~ $tls_ext ]]; then
19783+
if [[ ${forbidden_tls_ext[*]} =~ $tls_ext ]]; then
1978219784
pr_svrty_best "not vulnerable (OK)"; outln " - TLS extension $tls_ext detected"
1978319785
fileout "$jsonID" "OK" "not vulnerable - TLS extension $tls_ext detected" "$cve" "$cwe"
1978419786
return 0
@@ -24486,7 +24488,7 @@ debug_globals() {
2448624488
set_skip_tests() {
2448724489
local t
2448824490

24489-
for t in ${SKIP_TESTS[@]} ; do
24491+
for t in "${SKIP_TESTS[@]}"; do
2449024492
t="do_${t}"
2449124493
# declare won't do it here --> local scope
2449224494
eval "$t"=false
@@ -24671,7 +24673,7 @@ parse_cmd_line() {
2467124673
# then we need to make sure we catch --ids-friendly. Normally we do not,
2467224674
# see #1717. The following statement makes sure. In the do-while + case-esac
2467324675
# loop it will be execute again, but it does not hurt
24674-
if [[ "${CMDLINE_ARRAY[@]}" =~ --ids-friendly ]]; then
24676+
if [[ "${CMDLINE_ARRAY[*]}" =~ --ids-friendly ]]; then
2467524677
OFFENSIVE=false
2467624678
fi
2467724679
do_vulnerabilities=true
@@ -25204,7 +25206,7 @@ parse_cmd_line() {
2520425206

2520525207
# Unless explicit disabled, check if rating can or should be enabled.
2520625208
# Should be called after set_scanning_defaults() and set_skip_tests()
25207-
if [[ ! ${SKIP_TESTS[@]} =~ rating ]] ; then
25209+
if [[ ! ${SKIP_TESTS[*]} =~ rating ]] ; then
2520825210
set_rating_state
2520925211
fi
2521025212

0 commit comments

Comments
 (0)