Warn against variable substring removal

[hseg]

For new checks and feature suggestions

• https://www.shellcheck.net/ (i.e. the latest commit) currently gives no useful warnings about this
• I searched through https://github.com/koalaman/shellcheck/issues and didn't find anything related

Here's a snippet or screenshot that shows the problem:

#!/bin/bash
base="[hello] [world]"
pref="[hello]
suff="[world]"
pref="${base%$suff}"
# sets to $base, not "hello ", because $base doesn't end in any of the characters d,l,o,r,w

Here's what shellcheck currently says:

Nothing

Here's what I wanted or expected to see:

Warning: the substring removal expansion accepts a pattern, not a literal string.
Use slicing operators instead:

"${base%suff}" -> "${base:0:${#base}-${#suff}}"
"${base#pref}" -> "${base:${#pref}}"

(note: this advice isn't perfect for suffixes, since if the "suffix" is longer than the base, this will silently remove len(suff)-len(base) characters from the end of $base)

[koalaman]

Rather than using length, the pattern can be quoted: pref="${base%"$suff"}". ShellCheck warns about missing quotes causing pattern matching in several other cases, so this makes sense.

I had a look at 26 cases. 16 used it on file paths and URLs where they ideally should be quoted, 5 were constant values that didn't need but could be quoted, 4 used it on other things where they should ideally have been quoted, and 1 was a utility function where I wasn't sure if it was meant to be used with patterns or not.

While it's a nice and low false positive rate, I likely has a low IRL impact, so I'm not sure about the signal to noise ratio. Let's try it out and optionally adjust it later.

Thanks!