$ show anordal/shellharden
Shellharden is a CLI tool written in Rust that parses bash scripts to detect and suggest fixes for insecure quoting practices (missing double quotes on variable expansions and command substitutions). It functions as a corrective syntax highlighter, outputting the script with color-coded syntax and background highlights for suggested changes. The tool supports modes: highlighting, diff, transform (apply changes), check (exit with code 2 if changes needed), and replace (in-place file modification). The core architecture is a stack-based state machine where each parsing context (command, argument, string, comment, heredoc, variable, etc.) is represented by a separate struct implementing the `Situation` trait. Input bytes are processed through a horizon buffer, and the machine outputs colored or transformed bytes. The code is self-contained with zero external Rust dependencies, relying only on the standard library. It includes a comprehensive test suite with unit tests for individual parsing states and integration tests using real bash scripts. The project demonstrates careful handling of bash's syntactic edge cases, such as nested substitutions, heredocs, associative arrays, and the complex quoting rules of backticks vs `$()`.
The LLM identified 4 files worth highlighting for reuse:
Implements a generic byte-stream processing engine driven by a stack of `Situation` objects. Handles buffering with a horizon, lookahead, and output of colored/transformed slices. This module is reusable as a generic state machine framework for any parsing task that processes input incrementally and can output modifications.
Provides small, self-contained functions for common parsing operations: prefix matching (`prefixlen`), predicate-based length (`predlen`), identifier detection (`identifierlen`, `is_identifierhead/tail`), and character classification. These are pure functions with no dependencies on the rest of the codebase, making them directly extractable and reusable in any text processing project.
Implements the `SitMagic` situation that handles 'magic' syntactic contexts in bash: `[[ ... ]]`, `$(( ... ))`, and nested arithmetic/comparison. It correctly identifies opening `[[` or `$((` and pushes new `SitMagic` instances for nesting, then pops on the corresponding closing token. This pattern demonstrates how to handle context-sensitive syntax with a stack of states and is a model for implementing nested delimiters.
Handles the `test` and `[` builtin commands with domain-specific knowledge: it recognizes `-z`/`-n` flags and rewrites them to explicit string comparisons (`= ""` / `!= ""`), and identifies the `xyes` idiom (e.g., `test x"$var" = xyes`) to simplify. This component demonstrates how to embed business logic (shellcheck rules) into a state machine and apply non-trivial transformations, all while remaining testable and modular.