[PATCH 2/6] CodingGuidelines: quote assigned value in 'local var=$val'

From: Junio C Hamano <gitster@pobox.com>
Date: Apr 6, 2024, 00:08 UTC
Message-ID: <20240406000902.3082301-3-gitster@pobox.com>
In-Reply-To: <20240406000902.3082301-1-gitster@pobox.com>

Dash bug https://bugs.launchpad.net/ubuntu/+source/dash/+bug/139097 lets the shell erroneously perform field splitting on the expansion of a command substitution during declaration of a local or an extern variable.

The explanation was stolen from ebee5580 (parallel-checkout: avoid dash local bug in tests, 2021-06-06).

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 Documentation/CodingGuidelines | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/Documentation/CodingGuidelines b/Documentation/CodingGuidelines
index 0a39205c48..1cb77a871b 100644
--- a/Documentation/CodingGuidelines
+++ b/Documentation/CodingGuidelines
@@ -194,6 +194,20 @@ For shell scripts specifically (not exhaustive):
    have changed since then.  We'd need to re-evaluate this rule,
    together with the rule in t/check-non-portable-shell.pl script.
 
+ - Some versions of dash have broken variable assignment when prefixed
+   with "local", "export", and "readonly", in that the value to be
+   assigned goes through field splitting at $IFS unless quoted.
+
+   DO NOT write:
+
+     local variable=$value           ;# wrong
+     local variable=$(command args)  ;# wrong
+
+   and instead write:
+
+     local variable="$value"
+     local variable="$(command args)"
+
  - Use octal escape sequences (e.g. "\302\242"), not hexadecimal (e.g.
    "\xc2\xa2") in printf format strings, since hexadecimal escape
    sequences are not portable.

-- 
2.44.0-501-g19981daefd