In kerl line 448:

    echo $1 | sed $SED_OPT -e 's/R?([0-9]{1,2}).+/\1/'
         ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 490:
    INDEX=$(grep -n -m1 "$2" $1 | cut -d: -f1)
                             ^-- SC2086: Double quote to prevent globbing and word splitting.

--
        tail -n +$(($INDEX+3)) $1 | \
                               ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 586:
    download $1
             ^-- SC2086: Double quote to prevent globbing and word splitting.

--
In kerl line 652:
            if ! echo $KERL_CONFIGURE_OPTIONS | grep "darwin-64bit" >/dev/null 2>&1; then
                      ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 658:
                    if ! echo $KERL_CONFIGURE_OPTIONS | grep "ssl" >/dev/null 2>&1; then
                              ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 732:
        ./otp_build autoconf $KERL_CONFIGURE_OPTIONS >>"$LOGFILE" 2>&1 && \
                             ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 738:
    if ! echo $KERL_CONFIGURE_OPTIONS | grep "--enable-native-libs" >/dev/null 2>&1; then
              ^-- SC2086: Double quote to prevent globbing and word splitting.

--
In kerl line 1110:
    PARENT_CMD=$(ps -p $PARENT_PID -o ucomm | tail -n 1)
                       ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1137:
    OTP_VERSION=$(get_otp_version $1)
                                  ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1140:
    if ! echo $OTP_VERSION | grep "$DOCSH_SUPPORTED" >/dev/null 2>&1; then
              ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1163:
    if ! git clone -l "$KERL_GIT_DIR/$GIT" $DOCSH_DIR >/dev/null 2>&1; then
                                           ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1167:
    cd $DOCSH_DIR || exit 1
       ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1183:
    if [ -f $ACTIVE_PATH/lib/docsh ]; then
            ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1188:
        cp -R $DOCSH_DIR/_build/default/lib/docsh $ACTIVE_PATH/lib/
              ^-- SC2086: Double quote to prevent globbing and word splitting.
                                                  ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1191:
    if [ -f $ACTIVE_PATH/lib/docsh/dot.erlang ]; then
            ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1196:
        cat $DOCSH_DIR/templates/dot.erlang >$ACTIVE_PATH/lib/docsh/dot.erlang
            ^-- SC2086: Double quote to prevent globbing and word splitting.
                                             ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1199:
    if [ -f $HOME/.erlang ]; then
            ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1206:
    if [ -f $ACTIVE_PATH/lib/docsh/user_default.beam ]; then
            ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1211:
        erlc -I $DOCSH_DIR/include -o $ACTIVE_PATH/lib/docsh/ $DOCSH_DIR/templates/user_default.erl
                ^-- SC2086: Double quote to prevent globbing and word splitting.
                                      ^-- SC2086: Double quote to prevent globbing and word splitting.
                                                              ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1235:
    mkdir -p $dialyzerd || exit 1
             ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1239:
    dirs=$(find $1/lib -maxdepth 2 -name ebin -type d -exec dirname {} \;)
                ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1240:
    apps=$(for app in $dirs; do basename $app | cut -d- -f1 ; done | grep -Ev 'erl_interface|jinterface' | xargs echo)
                                         ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1241:
    $dialyzer --output_plt $plt --build_plt --apps $apps >>$build_log 2>&1
                           ^-- SC2086: Double quote to prevent globbing and word splitting.
                                                           ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1259:
            echo $plt
                 ^-- SC2086: Double quote to prevent globbing and word splitting.

--
In kerl line 1425:
    INSTALLED_NAME=$(get_name_from_install_path $candidate)
                                                ^-- SC2086: Double quote to prevent globbing and word splitting.

--
In kerl line 1437:
            if [ $count -ne 3 ]; then
                 ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1578:
    if [ $release -ge 17 ]; then
         ^-- SC2086: Double quote to prevent globbing and word splitting.

In kerl line 1943:
                if [ "$(basename $ins)" = "$2" ]; then
                                 ^-- SC2086: Double quote to prevent globbing and word splitting.

1 files changed, 44 insertions, 47 deletions

diff --git a/kerl b/kerl
index 6cc2498..736b022 100755
--- a/kerl
+++ b/kerl
@@ -445,7 +445,7 @@ do_git_build()
 
 get_otp_version()
 {
-    echo $1 | sed $SED_OPT -e 's/R?([0-9]{1,2}).+/\1/'
+    echo "$1" | sed $SED_OPT -e 's/R?([0-9]{1,2}).+/\1/'
 }
 
 get_perl_version()
@@ -487,13 +487,13 @@ show_configuration_warnings()
     # $1 is logfile
     # $2 is section header (E.g. "APPLICATIONS DISABLED")
     # Find the row number for the section we are looking for
-    INDEX=$(grep -n -m1 "$2" $1 | cut -d: -f1)
+    INDEX=$(grep -n -m1 "$2" "$1" | cut -d: -f1)
 
     # If there are no warnings, the section won't appear in the log
     if [ -n "$INDEX" ]; then
         # Skip the section header, find the end line and skip it
         # then print the results indented
-        tail -n +$(($INDEX+3)) $1 | \
+        tail -n +$(($INDEX+3)) "$1" | \
             sed -n '1,/\*/p' | \
             awk -F: -v logfile="$1" -v section="$2" \
                 'BEGIN { printf "%s (See: %s)\n", section, logfile }
@@ -588,7 +588,7 @@ do_normal_build()
     assert_valid_release "$1"
     assert_build_name_unused "$2"
     FILENAME=""
-    download $1
+    download "$1"
     mkdir -p "$KERL_BUILD_DIR/$2" || exit 1
     if [ ! -d "$KERL_BUILD_DIR/$2/$FILENAME" ]; then
         echo "Extracting source code"
@@ -654,13 +654,13 @@ _do_build()
             # Ensure that the --enable-darwin-64bit flag is set on all macOS
             # That way even on older Erlangs we get 64 bit Erlang builds
             # macOS has been mandatory 64 bit for a while
-            if ! echo $KERL_CONFIGURE_OPTIONS | grep "darwin-64bit" >/dev/null 2>&1; then
+            if ! echo "$KERL_CONFIGURE_OPTIONS" | grep "darwin-64bit" >/dev/null 2>&1; then
                 KERL_CONFIGURE_OPTIONS="$KERL_CONFIGURE_OPTIONS --enable-darwin-64bit"
             fi
 
             case "$OSVERSION" in
                 17*|16*|15*)
-                    if ! echo $KERL_CONFIGURE_OPTIONS | grep "ssl" >/dev/null 2>&1; then
+                    if ! echo "$KERL_CONFIGURE_OPTIONS" | grep "ssl" >/dev/null 2>&1; then
                         whichbrew=$(which brew)
                         if [ -n "$whichbrew" ] && [ -x "$whichbrew" ]; then
                             brew_prefix=$(brew --prefix openssl)
@@ -740,7 +740,7 @@ _do_build()
         _flags ./otp_build configure $KERL_CONFIGURE_OPTIONS >>"$LOGFILE" 2>&1
 
     fi
-    if ! echo $KERL_CONFIGURE_OPTIONS | grep "--enable-native-libs" >/dev/null 2>&1; then
+    if ! echo "$KERL_CONFIGURE_OPTIONS" | grep "--enable-native-libs" >/dev/null 2>&1; then
         make clean >>"$LOGFILE" 2>&1
         if ! _flags ./otp_build configure $KERL_CONFIGURE_OPTIONS >>"$LOGFILE" 2>&1; then
             show_logfile "Configure failed." "$LOGFILE"
@@ -1112,7 +1112,7 @@ ACTIVATE_CSH
 
     PID=$$
     PARENT_PID=$(ps -p $PID -o ppid | grep -E "[0-9]+" -o)
-    PARENT_CMD=$(ps -p $PARENT_PID -o ucomm | tail -n 1)
+    PARENT_CMD=$(ps -p "$PARENT_PID" -o ucomm | tail -n 1)
     case "$PARENT_CMD" in
         fish)
             SHELL_SUFFIX=".fish"
@@ -1134,15 +1134,15 @@ ACTIVATE_CSH
 install_docsh() {
     REPO_URL=$DOCSH_GITHUB_URL
     GIT=$(printf '%s' $REPO_URL | $MD5SUM | cut -d ' ' -f $MD5SUM_FIELD)
-    BUILDNAME=$1
+    BUILDNAME="$1"
     DOCSH_DIR="$KERL_BUILD_DIR/$BUILDNAME/docsh"
-    DOCSH_REF="0.5.0"
-    ACTIVE_PATH=$2
+    DOCSH_REF='0.5.0'
+    ACTIVE_PATH="$2"
 
-    OTP_VERSION=$(get_otp_version $1)
+    OTP_VERSION=$(get_otp_version "$1")
     # This has to be updated with docsh updates
     DOCSH_SUPPORTED='^1[89]\|20$'
-    if ! echo $OTP_VERSION | grep "$DOCSH_SUPPORTED" >/dev/null 2>&1; then
+    if ! echo "$OTP_VERSION" | grep "$DOCSH_SUPPORTED" >/dev/null 2>&1; then
         echo "Erlang/OTP version $OTP_VERSION not supported by docsh (does not match regex $DOCSH_SUPPORTED)"
         exit 1
     fi
@@ -1165,11 +1165,11 @@ install_docsh() {
     rm -Rf "$DOCSH_DIR"
     mkdir -p "$DOCSH_DIR" || exit 1
     cd "$DOCSH_DIR" || exit 1
-    if ! git clone -l "$KERL_GIT_DIR/$GIT" $DOCSH_DIR >/dev/null 2>&1; then
+    if ! git clone -l "$KERL_GIT_DIR/$GIT" "$DOCSH_DIR" >/dev/null 2>&1; then
         echo "Error cloning local git repository"
         exit 1
     fi
-    cd $DOCSH_DIR || exit 1
+    cd "$DOCSH_DIR" || exit 1
     if ! git checkout "$DOCSH_REF" >/dev/null 2>&1; then
         if ! git checkout -b "$DOCSH_REF" "$DOCSH_REF" >/dev/null 2>&1; then
             echo "Couldn't checkout specified version"
@@ -1185,35 +1185,35 @@ install_docsh() {
     fi
 
     ## Install docsh
-    if [ -f $ACTIVE_PATH/lib/docsh ]; then
+    if [ -f "$ACTIVE_PATH"/lib/docsh ]; then
         echo "Couldn't install $ACTIVE_PATH/lib/docsh - the directory already exists"
         rm -Rf "$DOCSH_DIR"
         exit 1
     else
-        cp -R $DOCSH_DIR/_build/default/lib/docsh $ACTIVE_PATH/lib/
+        cp -R "$DOCSH_DIR"/_build/default/lib/docsh "$ACTIVE_PATH"/lib/
     fi
     ## Prepare dot.erlang for linking as $HOME/.erlang
-    if [ -f $ACTIVE_PATH/lib/docsh/dot.erlang ]; then
+    if [ -f "$ACTIVE_PATH"/lib/docsh/dot.erlang ]; then
         echo "Couldn't install $ACTIVE_PATH/lib/docsh/dot.erlang - the file already exists"
         rm -Rf "$DOCSH_DIR"
         exit 1
     else
-        cat $DOCSH_DIR/templates/dot.erlang >$ACTIVE_PATH/lib/docsh/dot.erlang
+        cat "$DOCSH_DIR"/templates/dot.erlang >"$ACTIVE_PATH"/lib/docsh/dot.erlang
     fi
     ## Warn if $HOME/.erlang exists
-    if [ -f $HOME/.erlang ]; then
+    if [ -f "$HOME"/.erlang ]; then
         echo "$HOME/.erlang exists - kerl won't be able to symlink a docsh-compatible version."
         echo "Please make sure your $HOME/.erlang contains code"
         echo "from $ACTIVE_PATH/lib/docsh/dot.erlang"
         echo "and export KERL_DOCSH_DOT_ERLANG=exists to suppress further warnings"
     fi
     ## Install docsh user_default
-    if [ -f $ACTIVE_PATH/lib/docsh/user_default.beam ]; then
+    if [ -f "$ACTIVE_PATH"/lib/docsh/user_default.beam ]; then
         echo "Couldn't install $ACTIVE_PATH/lib/docsh/user_default.beam - the file already exists"
         rm -Rf "$DOCSH_DIR"
         exit 1
     else
-        erlc -I $DOCSH_DIR/include -o $ACTIVE_PATH/lib/docsh/ $DOCSH_DIR/templates/user_default.erl
+        erlc -I "$DOCSH_DIR"/include -o "$ACTIVE_PATH"/lib/docsh/ "$DOCSH_DIR"/templates/user_default.erl
     fi
 }
 
@@ -1236,14 +1236,13 @@ download_htmldocs()
 
 build_plt()
 {
-    dialyzerd=$1/dialyzer
-    mkdir -p $dialyzerd || exit 1
-    plt=$dialyzerd/plt
-    build_log=$dialyzerd/build.log
-    dialyzer=$1/bin/dialyzer
-    dirs=$(find $1/lib -maxdepth 2 -name ebin -type d -exec dirname {} \;)
-    apps=$(for app in $dirs; do basename $app | cut -d- -f1 ; done | grep -Ev 'erl_interface|jinterface' | xargs echo)
-    $dialyzer --output_plt $plt --build_plt --apps $apps >>$build_log 2>&1
+    dialyzerd="$1"/dialyzer
+    mkdir -p "$dialyzerd" || exit 1
+    plt="$dialyzerd"/plt
+    build_log="$dialyzerd"/build.log
+    dirs=$(find "$1"/lib -maxdepth 2 -name ebin -type d -exec dirname {} \;)
+    apps=$(for app in $dirs; do basename "$app" | cut -d- -f1 ; done | grep -Ev 'erl_interface|jinterface' | xargs echo)
+    "$1"/bin/dialyzer --output_plt "$plt" --build_plt --apps $apps >>"$build_log" 2>&1
     status=$?
     if [ $status -eq 0 ] || [ $status -eq 2 ]; then
         echo "Done building $plt"
@@ -1258,10 +1257,10 @@ do_plt()
 {
     ACTIVE_PATH="$1"
     if [ -n "$ACTIVE_PATH" ]; then
-        plt=$ACTIVE_PATH/dialyzer/plt
+        plt="$ACTIVE_PATH"/dialyzer/plt
         if [ -f "$plt" ]; then
             echo "Dialyzer PLT for the active installation is:"
-            echo $plt
+            echo "$plt"
             return 0
         else
             echo "There's no Dialyzer PLT for the active installation"
@@ -1315,12 +1314,12 @@ do_deploy()
         exit 1
     fi
 
-    if ! ssh $KERL_DEPLOY_SSH_OPTIONS "$host" "cd \"$remotepath\" && env ERL_TOP=\"\`pwd\`\" ./Install $INSTALL_OPT \"\`pwd\`\" >/dev/null 2>&1"; then
+    if ! ssh $KERL_DEPLOY_SSH_OPTIONS "$host" "cd \"$remotepath\" && env ERL_TOP=\"\$(pwd)\" ./Install $INSTALL_OPT \"\$(pwd)\" >/dev/null 2>&1"; then
         echo "Couldn't install Erlang/OTP $rel to $host ($remotepath)"
         exit 1
     fi
 
-    if ! ssh $KERL_DEPLOY_SSH_OPTIONS "$host" "cd \"$remotepath\" && sed -i -e \"s#$path#\"\`pwd\`\"#g\" activate"; then
+    if ! ssh $KERL_DEPLOY_SSH_OPTIONS "$host" "cd \"$remotepath\" && sed -i -e \"s#$path#\"\$(pwd)\"#g\" activate"; then
         echo "Couldn't completely install Erlang/OTP $rel to $host ($remotepath)"
         exit 1
     fi
@@ -1404,9 +1403,8 @@ is_valid_install_path()
 {
 
     # don't allow installs into .erlang because
-    # it's a special configuration file location
-    # for OTP
-    if [ $(basename -- "$1") = ".erlang" ]; then
+    # it's a special configuration file location for OTP
+    if [ "$(basename -- "$1")" = ".erlang" ]; then
         echo "ERROR: You cannot install a build into '.erlang'. (It's a special configuration file location for OTP.)"
         return 1
     fi
@@ -1427,25 +1425,24 @@ is_valid_install_path()
         return 1
     fi
 
-    INSTALLED_NAME=$(get_name_from_install_path $candidate)
+    INSTALLED_NAME=$(get_name_from_install_path "$candidate")
     if [ -n "$INSTALLED_NAME" ]; then
         echo "ERROR: Installation ($INSTALLED_NAME) already registered for this location ($1)"
         return 1
     fi
 
     # if the install directory exists,
-    # do not allow installs into a directory
-    # that is not empty
+    # do not allow installs into a directory that is not empty
     if [ -e "$1" ]; then
-        if [ -d "$1" ]; then
+        if [ ! -d "$1" ]; then
+            echo "ERROR: $1 is not a directory."
+            return 1
+        else
             count=$(ls -la "$1" | wc -l)
-            if [ $count -ne 3 ]; then
+            if [ "$count" -ne 3 ]; then
                 echo "ERROR: $1 does not appear to be an empty directory."
                 return 1
             fi
-        else
-            echo "ERROR: $1 is not a directory."
-            return 1
         fi
     fi
 
@@ -1580,7 +1577,7 @@ do_active()
 make_filename()
 {
     release=$(get_otp_version "$1")
-    if [ $release -ge 17 ]; then
+    if [ "$release" -ge 17 ]; then
         echo "OTP-$1"
     else
         echo "OTP_$1"
@@ -2032,7 +2029,7 @@ case "$1" in
             # - prefer $KERL_DEFAULT_INSTALL_DIR
             match=
             for ins in $(list_print installations | cut -d' ' -f2); do
-                if [ "$(basename $ins)" = "$2" ]; then
+                if [ "$(basename "$ins")" = "$2" ]; then
                     if [ -z "$match" ]; then
                         match="$ins"
                     else