shellharden
A syntax highlighter and tool to semi-automatically rewrite shell scripts for ShellCheck conformance, focusing on proper quoting.
What is shellharden?
Shellharden is a tool that highlights bash syntax and semi-automatically rewrites shell scripts to comply with ShellCheck standards, primarily focusing on proper quoting. It helps developers identify and fix vulnerabilities in shell scripts by visualizing potential changes and offering automated transformations after code review.
Shell script developers, DevOps engineers, and system administrators who write or maintain bash scripts and want to improve code safety and adherence to best practices.
Developers choose Shellharden because it goes beyond static analysis by providing actionable fixes for quoting issues, integrates visually with syntax highlighting, and complements ShellCheck to harden scripts against common vulnerabilities.
Overview
The corrective bash syntax highlighter
Use Cases
Best For
- Identifying improper quoting in existing bash scripts
- Automating fixes for ShellCheck recommendations
- Improving security and reliability of shell scripts
- Learning safer bash practices through visual feedback
- Refactoring legacy shell scripts to modern standards
- Preventing word splitting and glob expansion vulnerabilities
Not Ideal For
- Scripts that intentionally rely on unquoted variables for word splitting or glob expansion, as transformations could break intended behavior.
- Fully automated CI/CD pipelines with no human intervention, since it requires code review before applying fixes.
- Projects using non-bash shells like zsh or fish, as it is specifically designed for bash syntax.
- Teams seeking a one-click solution for all shell script issues; ShellCheck is better for broad detection beyond quoting.
Pros & Cons
Pros
Uses color-coded syntax highlighting to show exactly where quotes should be added or removed, making vulnerabilities easy to spot in scripts.
Offers a --transform option to apply suggested quoting fixes, semi-automating the hardening process after human review.
Complements ShellCheck by providing fixes for detected issues, specifically focusing on quoting vulnerabilities for safer scripts.
Includes guidance on safer bash practices and encourages learning through visual feedback and the accompanying how-to document.
Cons
Cannot be applied blindly; scripts depending on unquoted behavior may break, necessitating careful code inspection, which adds overhead.
Primarily addresses quoting issues, so other ShellCheck warnings or bash pitfalls might require additional tools or manual fixes.
Only works for bash scripts, limiting its utility in environments with multiple shell types or non-bash scripts.
Frequently Asked Questions
Related Projects
PHP ParserA PHP parser written in PHP
TypeScript ESLint:sparkles: Monorepo for all the tooling which enables ESLint to support TypeScript
pyrightStatic Type Checker for Python
Reviewdog🐶 Automated code review tool integrated with any code analysis tools regardless of programming language
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.