Warn about possibly dangerous rm commands about shellcheck

[waja]

+1

[HairyFotr]

It might be good to suggest quoting when rm has multiple parameters. It would have false positives, but it would prevent errors caused by misplaced/unquoted spaces.

[koalaman]

Some support for this is added in 197b3e3. The design goal was to minimize false positives.

ShellCheck assumes that all commands will produce user's expected output if they run, but that they may fail to expand due to memory or fork limits. It also assumes that any reference to the variable in a condition means it's been checked.

Additionally, if you put literally rm -r /etc, it gives a courtesy message that can be disabled using --.

Here are the unit tests expected to produce warning:

verify "rm -r $1/$2"
verify "foo=$(echo bar); rm -r /home/$foo"
verify "foo=/home; user=$(whoami); rm -r \"$foo/$user\""
verify "rm --recursive /etc/*$config*"
verify "rm -rf /home"

These cases are expected not to produce warnings:

verifyNot "var=$(cmd); if [ -n \"$var\" ]; then rm -r /etc/$var/*; fi"
verifyNot "foo=/home; user=cow; rm -r \"$foo/$user\""
verifyNot "user=$(whoami); rm -r /home/${user:?Nope}"
verifyNot "rm -rf -- /home"  

Circumventing the check is trivial, e.g.

var=$(foo) || echo "I'm about to delete all your files!"
rm -rf /usr/$var

since the assignment was made as part of a conditional block, shellcheck assumes you know what you're doing.

[HairyFotr]

The rm -rf / bug in Steam for Linux is making the news these days.

Shellcheck doesn't detect it. Here's a link to the line: https://github.com/indrora/steam_latest/blob/05e3d6efa60af71e11098bf7dd973828604354ce/scripts/steam.sh#L352