bash-safety

Bash Safety

Review bash commands for dangerous patterns and interpret exit codes correctly.

Exit code semantics

Not every non-zero exit code is an error. The following commands use non-zero exits to convey information:

Command	Exit 0	Exit 1	Exit 2+
grep / rg	Matches found	No matches (not an error)	Real error
find	Success	Some directories inaccessible	Real error
diff	No differences	Files differ (not an error)	Real error
test / [	Condition true	Condition false (not an error)	Real error

Common mistake: treating grep exit 1 as an error in a pipeline, causing the whole script to abort when set -e is active. Fix:

# Wrong — aborts on no matches
grep "pattern" file.txt

# Correct — treats no-match as non-error
grep "pattern" file.txt || true

# Or check explicitly
if grep -q "pattern" file.txt; then
  echo "found"
else
  echo "not found"  # exit 1, not an error
fi

Dangerous patterns to review

Command substitution injection

These patterns can execute arbitrary code:

• $() — command substitution
• ` ` — backtick substitution
• <() / >() — process substitution
• =cmd at word-start (zsh) — equals expansion, bypasses binary allowlists

Heredoc injection

# Dangerous: heredoc inside $()
$(cat <<EOF
  rm -rf /
EOF
)

IFS injection

# Dangerous: setting IFS changes how word-splitting works
IFS=/ read -r a b <<< "$path"
# Can cause unexpected word splitting in subsequent commands

Dangerous variables

• $LD_PRELOAD — injects shared libraries into subsequent processes
• $DYLD_INSERT_LIBRARIES — macOS equivalent
• Unquoted $@ or $* — word-splits on spaces in arguments

Zsh-specific patterns to block

These zsh-specific patterns can bypass command allowlists or execute code through modules:

• zmodload — loads zsh modules that enable dangerous operations (file I/O, TCP, pseudo-terminals)
• emulate -c — eval-equivalent
• sysopen, sysread, syswrite — low-level file descriptor operations via zsh/system
• ztcp, zsocket — network operations via zsh/net
• zf_rm, zf_mv, zf_chmod — builtin filesystem operations that bypass binary checks

Review checklist

Before running an unfamiliar script:

1. Quoting — are variables quoted? Unquoted $var splits on spaces and globs
2. set -e behaviour — if set -e is active, will grep/diff/test exits cause unexpected aborts?
3. Destructive commands — is rm or rm -rf present? What path does it target?
4. Command substitution — does $() or backtick expand user-controlled input?
5. Redirections — does > or >> target a sensitive file?
6. sudo — is sudo present? What command does it run?
7. Network — does the script make outbound connections (curl, wget, nc)?

Reviewing a script

When asked to review a script, go through the checklist above and report:

• Any exit code interpretation issues (grep exit 1 treated as error, etc.)
• Any dangerous patterns found, with the specific line
• Whether the script is safe to run as-is, or what needs changing