Metadata

ID: bash-security/unquoted-patterns-in-double-brackets

Language: Bash

Severity: Warning

Category: Security

CWE: 155

Description

In [[ "$x" == $y ]] or [[ "$x" != $y ]], an unquoted right-hand side is interpreted as a pattern, not a literal string. If $y is wildcard-like (for example *) or attacker- controlled, the condition may match unexpectedly and bypass access checks.

Quote the right-hand side to force literal comparison, for example: [[ "$x" == "$y" ]].

Non-Compliant Code Examples

#!/bin/bash
[[ "$x" == $y ]]
[[ "$x" != ${rhs} ]]
[[ "$x" == prefix-${y} ]]

Compliant Code Examples

#!/bin/bash
[[ "$x" == "$y" ]]
[[ "$x" != "${y}" ]]
[[ "$x" == "prefix-${y}" ]]
[[ "$x" == literal ]]
[[ "$x" == *.txt ]]
[[ "$line" == *$'\t'* ]]
[ "$x" = "$y" ]

Seamless integrations. Try Datadog Code Security

Datadog Code Security