Skip to content

[Bug]: SonarQube reliability issue #5342

Open

Description

@serhii-lyzun

Bug Description

For ...sh scripts, there is the issue:
Use "[[" instead of "[" for conditional tests

Why is this an issue:

`The traditional [ command (also known as test) is an external command that treats its arguments as separate words, making it vulnerable to word splitting and pathname expansion issues. This can lead to unexpected behavior when variables contain spaces, special characters, or when filenames match glob patterns.

The modern [[ construct is part of Bash syntax rather than a separate command. This means:

Word splitting and pathname expansion do not occur within [[ ]], making it more robust when handling variables that might contain spaces or special characters
It provides better error handling and more predictable behavior
It offers additional features like regular expression matching with the =~ operator
It’s generally faster since it doesn’t require spawning an external process
Using [ can cause subtle bugs that are difficult to debug, especially when dealing with user input, filenames, or variables that might be empty or contain unexpected characters.

What is the potential impact?
Using the traditional [ command instead of [[ can lead to script failures or unexpected behavior when:

Variables contain spaces, tabs, or newlines
Filenames contain special characters or match glob patterns
Variables are empty or unset
These issues can cause scripts to behave unpredictably in production environments, potentially leading to data loss, security vulnerabilities, or system instability. Scripts without a shebang are not checked because their shell interpreter cannot be determined. We assume that POSIX compatibility is required.`

Steps to Reproduce

  1. specify init my-project --integration
  2. Chose sh scripts
  3. Open sh script in .specify folder
  4. Validate with SonarQube/Cloud

Expected Behavior

No issue from SonarQube

Actual Behavior

Use "[[" instead of "[" for conditional tests

Specify CLI Version

1.3.2

AI Agent

Claude Code

Operating System

macOS

Python Version

3.11.5

Error Logs

Additional Context

No response

AI Disclosure

N/A

Activity

  1. added
    triage-out-of-scopeVerdict: won't land in core — invalid, duplicate, off-mission, or redirected to an extension
    and removed on Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugtriage-out-of-scopeVerdict: won't land in core — invalid, duplicate, off-mission, or redirected to an extension

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions