Writing a command and then testing $? in a separate [/[[/test condition is redundant and brittle:
another command between them changes $?, set -e can exit before the check, and [/[[ themselves
overwrite $? before the branch body runs. It is better to use if cmd; then, if ! cmd; then, or capturing the output with
if ! out=$(cmd); then instead of inspecting $? in the conditional.
Non-Compliant Code Examples
#!/bin/bash
make all;if[$? -eq 0];then :;fiif[[$? -ne 0]];then :;fiif["${?}" -eq 0];then :;fitest$? -eq 0&&echo bad
/usr/bin/test $? -eq 0
Compliant Code Examples
#!/bin/bash
if grep -q pat file;thenecho ok;fiif ! make all;thenecho fail;fiif[ -f "$f"];then :;firc=$?if["$rc" -eq 0];then :;fiecho"status was $?"iftest -n "$file";then :;fi/usr/bin/test -f "$path"&&echo ok
원활한 통합. Datadog Code Security 사용해 보기
Datadog Code Security
이 규칙을 사용해 Datadog Code Security로 코드 분석해 보기
이 규칙의 사용법
1
2
rulesets:- bash-code-quality # Rules to enforce Bash code quality.
리포지토리 루트에서 위의 콘텐츠를 사용해 static-analysis.datadog.yml 생성
Datadog의 무료 IDE Plugins를 사용하거나 Code Security 스캔을 CI 파이프라인에 추가