Potentially warn if local variable is declared with the assignment of an unquoted command substitution

[ghost]

For new checks and feature suggestions

• shellcheck.net (i.e. the latest commit) currently gives no useful warnings about this
• I searched through https://github.com/koalaman/shellcheck/issues and didn't find anything related

Here's a snippet or screenshot that shows the problem:

#!/bin/dash
hi() { echo "hello world"; }
test1() { local var=$(hi); echo "1: $var"; }
test2() { local var="$(hi)"; echo "2: $var"; }
test3() { local var=; var=$(hi); echo "3: $var"; }
test1; test2; test3

Here's what shellcheck currently says:

Line 3	SC2155: Declare and assign separately to avoid masking return values.
Line 4	SC2155: Declare and assign separately to avoid masking return values.

Here's what I wanted or expected to see:

A warning for Line 2 that declaring - and assigning the expansion of a command substitution to - a local variable in a single pass can be affected by word splitting in some shells, unless the expansion is double quoted. For example, in both dash and posh, the above program prints:-

1: hello
2: hello world
3: hello world

Whereas in most other shells supporting the local keyword - including bash, busybox ash, mksh and loksh - the program behaves exactly as one would expect:-

1: hello world
2: hello world
3: hello world

This is a surprising pitfall. Given that dash is a popular sh implementation and given the popularity of the local keyword - despite being a POSIX transgression - it may well result in confusion. As such, I think it merits a warning - be it as a facet of SC2086 or otherwise.

[koalaman]

Definitely agree. This is also an issue with export and is an artifact of how bash and shellcheck both do parsing to allow local foo=(bar baz) which would otherwise be invalid

[koalaman]

Interestingly, this was (re-)added in Dash in 2018 and released in 2020 for 0.5.11 in anticipation of POSIX starting to mandate the behavior: https://austingroupbugs.net/view.php?id=351

Until then, ShellCheck will warn about this in sh. Thanks!