Metadata

ID: bash-security/avoid-unquoted-unset

Language: Bash

Severity: Warning

Category: Security

CWE: 88

Description

Arguments to unset are expanded like other words: unquoted *, ?, and [ can trigger pathname expansion, so a matching filename can replace the argument and unset the wrong name (CWE-88). That is especially easy to miss with array elements written as unset arr[0] or unset foo[index], where [ starts a glob character class.

Quote or use single-quoted words so the name reaches unset literally, for example unset 'foo[index]' or unset 'arr[0]' instead of the unquoted forms.

Non-Compliant Code Examples

#!/bin/bash
unset *
unset foo[index]
unset arr[0]
unset ?
unset [a]
unset foo*

Compliant Code Examples

#!/bin/bash
unset foo
unset PATH
unset "$x"
unset 'foo[index]'
unset -v foo
unset -f myfunc
unset a$b

Seamless integrations. Try Datadog Code Security

Datadog Code Security