┌─────────────┐
│ Scan Status │
└─────────────┘
Scanning 1079 files tracked by git with 7 Code rules:
Scanning 103 files with 7 bash rules.
┌──────────────┐
│ Scan Summary │
└──────────────┘
✅ Scan completed successfully.
• Findings: 209 (209 blocking)
• Rules run: 7
• Targets scanned: 103
• Parsed lines: ~69.9%
• Scan skipped:
◦ Files larger than files 1.0 MB: 6
• For a detailed list of skipped files and lines, run semgrep with the --verbose flag
Ran 7 rules on 103 files: 209 findings.
┌───────────────────┐
│ 209 Code Findings │
└───────────────────┘
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/AUTOCONFIG.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
7┆ chat -e -v -c -D $devname OK-AT+CIMI-OK
⋮┆----------------------------------------
11┆ echo [$0]... No get Auto config infor,try again[$i]... > /dec/console
❯❱ external.semgrep-rules.bash.lang.best-practice.useless-cat
❰❰ Blocking ❱❱
Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to
a file.
15┆ sim_status=`cat /var/run/chat_xmlnode.conf | grep SIM`
⋮┆----------------------------------------
18┆ mcc=`cat /var/run/chat_xmlnode.conf | grep mcc= | scut -f 2`
⋮┆----------------------------------------
18┆ mcc=`cat /var/run/chat_xmlnode.conf | grep mcc= | scut -f 2`
⋮┆----------------------------------------
19┆ mnc1=`cat /var/run/chat_xmlnode.conf | grep mnc_1= | scut -f 2`
⋮┆----------------------------------------
19┆ mnc1=`cat /var/run/chat_xmlnode.conf | grep mnc_1= | scut -f 2`
⋮┆----------------------------------------
20┆ mnc2=`cat /var/run/chat_xmlnode.conf | grep mnc_2= | scut -f 2`
⋮┆----------------------------------------
20┆ mnc2=`cat /var/run/chat_xmlnode.conf | grep mnc_2= | scut -f 2`
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
23┆ xmldbc -P /etc/events/AUTOCONFIG.php -V mcc=$mcc -V mnc1=$mnc1 -V mnc2=$mnc2
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/DHCP4-RELEASE.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
4┆ PID=`cat $pidfile`
⋮┆----------------------------------------
6┆ kill -SIGUSR2 $PID
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/DHCP4-RENEW.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
4┆ PID=`cat $pidfile`
⋮┆----------------------------------------
6┆ kill -SIGUSR1 $PID
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/DHCPS-REDETECT.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ xmldbc -P /etc/events/DHCPS-REDETECT.php -V INF=$1 > /var/run/DHCPS-REDETECT.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/SEALPAC-CLEAR.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
9┆ [ -f $reload ] && xmldbc -P $reload
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/SEALPAC-LOAD.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
8┆ seama -x sealpac.tgz -i $dev -m type=sealpac
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/SEALPAC-SAVE.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
6┆ seama -i sealpac.tgz -m type=sealpac -m langcode=$lancode
⋮┆----------------------------------------
10┆ [ -f $reload ] && xmldbc -P $reload
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/UPDATELEASES.php
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
5┆ $inf_base = XNODE_getpathbytarget("/runtime", "inf", "uid", $INF, 0);
⋮┆----------------------------------------
5┆ $inf_base = XNODE_getpathbytarget("/runtime", "inf", "uid", $INF, 0);
⋮┆----------------------------------------
6┆ $leases_base = $inf_base."/dhcps4/leases";
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/UPDATELEASES.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ phpsh /etc/events/UPDATELEASES.php INF=$1 FILE=$2
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/WAN-1_dhcp_cb.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] ... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/WAN-DETECT.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] ... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/events/WAN-DETECT.php -V INF=$1 > /var/run/$1_DETECT.sh
⋮┆----------------------------------------
4┆ sh /var/run/$1_DETECT.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/WANV6-DETECT.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] [$2] [$3]... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/events/WANV6-DETECT.php -V INFV4=$1 -V INFLL=$2 -V INFV6=$3 >
/var/run/$1_DETECTV6.sh
⋮┆----------------------------------------
4┆ sh /var/run/$1_DETECTV6.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/WANV6_AUTOCONF_DETECT.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] [$2] ... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/events/WANV6_AUTOCONF_DETECT.php -V INF=$1 -V ACT=$2 >
/var/run/$1_autoconf_det_$2.sh
⋮┆----------------------------------------
4┆ sh /var/run/$1_autoconf_det_$2.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/WANV6_ppp_chk.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] ... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/events/WANV6_ppp_chk.php -V INF=$1 > /var/run/$1_ppp_chk.sh
⋮┆----------------------------------------
4┆ sh /var/run/$1_ppp_chk.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/WANV6_ppp_dis.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] [$2] ... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/events/WANV6_ppp_dis.php -V INF=$1 -V ACT=$2 > /var/run/$1_ppp_dis_$2.sh
⋮┆----------------------------------------
4┆ sh /var/run/$1_ppp_dis_$2.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/WAN_dhcp_chk.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] ... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/events/WAN_dhcp_chk.php -V INF=$1 > /var/run/$1_dhcp_chk.sh
⋮┆----------------------------------------
4┆ sh /var/run/$1_dhcp_chk.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/WAN_dhcp_pri.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] ... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/events/WAN_dhcp_pri.php -V INF=$1 > /var/run/$1_dhcp_pri.sh
⋮┆----------------------------------------
4┆ sh /var/run/$1_dhcp_pri.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/WAN_ppp_dis.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] [$2] ... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/events/WAN_ppp_dis.php -V INF=$1 -V ACT=$2 > /var/run/$1_ppp_dis_$2.sh
⋮┆----------------------------------------
4┆ sh /var/run/$1_ppp_dis_$2.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/checkfw.sh
❯❱ external.semgrep-rules.bash.lang.best-practice.useless-cat
❰❰ Blocking ❱❱
Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to
a file.
7┆ old_major=`cat /etc/config/buildver|cut -d'.' -f1`
⋮┆----------------------------------------
8┆ old_minor=`cat /etc/config/buildver|cut -d'.' -f2|cut -c1-2`
⋮┆----------------------------------------
8┆ old_minor=`cat /etc/config/buildver|cut -d'.' -f2|cut -c1-2`
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
19┆ rm -f $fwinfo
❱ external.semgrep-rules.bash.lang.correctness.unquoted-command-substitution-in-command
❰❰ Blocking ❱❱
The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other
separators specified by the IFS variable. You should surround it with double quotes to avoid
splitting the result.
22┆ `tcprequest "$reqstr" "$srv" 80 -f "$fwinfo" -t 5 -s`
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
28┆ xmldbc -s /runtime/firmware/fwversion/Major $new_major
⋮┆----------------------------------------
29┆ xmldbc -s /runtime/firmware/fwversion/Minor $new_minor
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/events/dhcp_pri_chk.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] [$2] [$3] ... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/events/dhcp_pri_chk.php -V PHYINF=$1 -V INF=$2 -V CONN=$3 >
/var/run/$2_dhcp_pri_chk.sh
⋮┆----------------------------------------
4┆ sh /var/run/$2_dhcp_pri_chk.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init.d/S20init.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
4┆ xmldb -n $image_sign -t > /dev/console &
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init.d/S20interfaces.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
8┆ [ "$MACADDR" != "" ] && ip link set eth2 addr $MACADDR
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init.d/rcS
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
7┆ $i
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S21layout.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
⋮┆----------------------------------------
5┆ service LAYOUT $1
⋮┆----------------------------------------
8┆ echo [$0]: invalid argument - $1 > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S21wlan.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
⋮┆----------------------------------------
8┆ service WIFI.WLAN-1 $1
⋮┆----------------------------------------
11┆ echo [$0]: invalid argument - $1 > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S40event.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S40gpioevent.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S41autowan.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S41autowanv6.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S41inf.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S42pthrough.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S65ddnsd.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/S80telnetd.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: $1 ... > /dev/console
⋮┆----------------------------------------
6┆ telnetd -l /usr/sbin/login -u Alphanetworks:$image_sign -i br0 &
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/init0.d/rcS
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
4┆ sh $KRC
⋮┆----------------------------------------
5┆ rm $KRC
⋮┆----------------------------------------
37┆ $i start
⋮┆----------------------------------------
40┆ [ -f $KRC ] && cat $KRC >> $KRC.tmp
⋮┆----------------------------------------
41┆ mv $KRC.tmp $KRC
⋮┆----------------------------------------
43┆ [ -f $KRC ] && chmod +x $KRC
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/conntrack_flush.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
3┆ echo [$0][start] > /dev/console
⋮┆----------------------------------------
8┆ echo $ICMP > $PROC
⋮┆----------------------------------------
9┆ echo [$0][finish] > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/dbload.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
33┆ sh $i
⋮┆----------------------------------------
36┆ xmldbc -P $i
⋮┆----------------------------------------
39┆ xmldbc -R $i
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/ddnsd_helper.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
4┆ echo [$0]: $1 $2 $3 (do nothing)... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/delpathbytarget.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] [$1] [$2] [$3] [$4] [$5]... > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/scripts/delpathbytarget.php -V BASE=$1 -V NODE=$2 -V TARGET=$3 -V VALUE=$4
-V POSTFIX=$5 > /dev/null
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/dlcfg_hlper.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
8┆ seama -i /var/config.xml.gz -m signature=$sign -m noheader=1 -m type=devconf -m dev=$devn
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/dns-helper.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
3┆ xmldbc -P /etc/scripts/libs/dns-helper.php -V ACTION=$1 -V TARGET=$2 -V DNS=$3 >
/var/run/dns-helper.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/getmodem.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] $1 $2 $3 ... > /dev/console
⋮┆----------------------------------------
3┆ echo [$0] $1 $2 $3 ... > /var/run/temp
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/igmpproxy_helper.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] $1 $2 $3 $4 ... > /dev/console
⋮┆----------------------------------------
4┆ xmldbc -P $PHPFILE -V ACTION=$1 -V GROUP=$2 -V IF=$3 -V SRC=$4 -V GROUPMAC=$5 -V SRCMAC=$6
> /var/run/igmpproxy_helper.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/ip-down
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: ifname[$1] device[$2] speed[$3] ip[$4] remote[$5] param[$6] > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/services/INET/ppp4_ipdown.php -V IFNAME=$1 -V DEVICE=$2 -V SPEED=$3 -V IP=$4
-V REMOTE=$5 -V PARAM=$6 > /var/run/ppp4_ipdown_$1.sh
⋮┆----------------------------------------
4┆ sh /var/run/ppp4_ipdown_$1.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/ip-up
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
4┆ echo [$0]: ifname[$1] device[$2] speed[$3] ip[$4] remote[$5] param[$6] > /dev/console
⋮┆----------------------------------------
6┆ xmldbc -P /etc/services/INET/ppp4_ipup.php -V IFNAME=$1 -V DEVICE=$2 -V SPEED=$3 -V IP=$4
-V REMOTE=$5 -V PARAM=$6 > /var/run/ppp4_ipup_$1.sh
⋮┆----------------------------------------
7┆ sh /var/run/ppp4_ipup_$1.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/ipv6-down
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0]: ifname[$1] device[$2] speed[$3] ip[$4] remote[$5] param[$6] > /dev/console
⋮┆----------------------------------------
3┆ xmldbc -P /etc/services/INET/ppp6_ipdown.php -V IFNAME=$1 -V DEVICE=$2 -V SPEED=$3 -V IP=$4
-V REMOTE=$5 -V PARAM=$6 > /var/run/ppp6_ipdown_$1.sh
⋮┆----------------------------------------
4┆ sh /var/run/ppp6_ipdown_$1.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/ipv6-up
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
4┆ echo [$0]: ifname[$1] device[$2] speed[$3] ip[$4] remote[$5] param[$6] > /dev/console
⋮┆----------------------------------------
6┆ xmldbc -P /etc/services/INET/ppp6_ipup.php -V IFNAME=$1 -V DEVICE=$2 -V SPEED=$3 -V IP=$4
-V REMOTE=$5 -V PARAM=$6 > /var/run/ppp6_ipup_$1.sh
⋮┆----------------------------------------
7┆ sh /var/run/ppp6_ipup_$1.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/killpid.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
3┆ pid=`pfile -f $1`
⋮┆----------------------------------------
4┆ [ "$pid" != "0" ] && kill $pid > /dev/console 2>&1
⋮┆----------------------------------------
5┆ rm -f $1
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/mldproxy_helper.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] $1 $2 $3 $4 ... > /dev/console
⋮┆----------------------------------------
4┆ xmldbc -P $PHPFILE -V ACTION=$1 -V GROUP=$2 -V IF=$3 -V SRC=$4 -V GROUPMAC=$5 -V SRCMAC=$6
> /var/run/mldproxy_helper.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/ping.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
6┆ rm -f $RSLT
⋮┆----------------------------------------
7┆ ping $2 > $RSLT
⋮┆----------------------------------------
11┆ cat $RSLT
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/ppp-status
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
6┆ sh /var/run/ppp4_status_$1.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/resetstats.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
3┆ iwpriv $1 set ResetCounter=1
⋮┆----------------------------------------
6┆ echo $1 > /proc/driver/ifresetcnt
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/setdate.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] $1 $2 $3 ... > /dev/console
⋮┆----------------------------------------
7┆ Y=`echo $1 | cut -d/ -f3`
⋮┆----------------------------------------
8┆ M=`echo $1 | cut -d/ -f1`
⋮┆----------------------------------------
9┆ D=`echo $1 | cut -d/ -f2`
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/settime.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] $1 $2 $3 ... > /dev/console
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/ubcom-monitor.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
19┆ echo $TRY_COUNT
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/ubcom-run.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] $1... > /dev/console
⋮┆----------------------------------------
12┆ kill $pid > /dev/null 2>&1
⋮┆----------------------------------------
19┆ $0 stop
⋮┆----------------------------------------
20┆ $0 start
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/upnp/M-SEARCH.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
10┆ sh /var/run/M-SEARCH.$2.$1.sh
⋮┆----------------------------------------
11┆ rm /var/run/M-SEARCH.$2.$1.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/upnp/NOTIFYAB.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
11┆ xmldbc -P /etc/scripts/upnp/NOTIFYAB.php -V NTS=$1 -V PHYINF=$3 -V IPADDR=$4 -V IPTYPE=$6 >
/var/run/notify.$1.$2.sh
⋮┆----------------------------------------
13┆ xmldbc -k upnp_alive_$2
⋮┆----------------------------------------
14┆ sh /var/run/notify.$1.$2.sh
⋮┆----------------------------------------
18┆ rm /var/run/notify.*.$2.sh
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/upwifistatshlper.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] $1 $2 $3 ....
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/scripts/wps.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
2┆ echo [$0] $1 ... > /dev/console
⋮┆----------------------------------------
9┆ devdata set -e pin=$PIN
⋮┆----------------------------------------
12┆ xmldbc -P $CFGSCRIPT -V PHY_UID=WLAN-1 > $WPSCONF
⋮┆----------------------------------------
13┆ wps -c $WPSCONF -e setup > /dev/console
⋮┆----------------------------------------
16┆ xmldbc -P $CFGSCRIPT -V PHY_UID=WLAN-1 -V PARAM=enrollee > $WPSCONF
⋮┆----------------------------------------
17┆ wps -c $WPSCONF > /dev/console &
⋮┆----------------------------------------
20┆ xmldbc -P $CFGSCRIPT -V PHY_UID=WLAN-1 > $WPSCONF
⋮┆----------------------------------------
21┆ wps -c $WPSCONF > /dev/console &
⋮┆----------------------------------------
24┆ xmldbc -P $WPSUPSTATE -V PHY_UID=WLAN-1 -V STATE=WPS_IN_PROGRESS > /dev/console &
⋮┆----------------------------------------
26┆ xmldbc -P $CFGSCRIPT -V PHY_UID=WLAN-1 > $WPSCONF
⋮┆----------------------------------------
27┆ wps -c $WPSCONF -e int:pin > /dev/console &
⋮┆----------------------------------------
30┆ xmldbc -P $WPSUPSTATE -V PHY_UID=WLAN-1 -V STATE=WPS_IN_PROGRESS > /dev/console &
⋮┆----------------------------------------
32┆ xmldbc -P $CFGSCRIPT -V PHY_UID=WLAN-1 -V PBC=1 > $WPSCONF
⋮┆----------------------------------------
33┆ wps -c $WPSCONF -e int:pbc > /dev/console &
⋮┆----------------------------------------
45┆ xmldbc -P $WPSUPSTATE -V PHY_UID=WLAN-1 -V STATE=WPS_NONE > /dev/console &
⋮┆----------------------------------------
49┆ xmldbc -P $WPSUPSTATE -V PHY_UID=WLAN-1 -V STATE=WPS_IN_PROGRESS > /dev/console &
⋮┆----------------------------------------
53┆ xmldbc -P $WPSUPSTATE -V PHY_UID=WLAN-1 -V STATE=WPS_ERROR > /dev/console &
⋮┆----------------------------------------
57┆ xmldbc -P $WPSUPSTATE -V PHY_UID=WLAN-1 -V STATE=WPS_OVERLAP > /dev/console &
⋮┆----------------------------------------
61┆ xmldbc -P $WPSUPSTATE -V PHY_UID=WLAN-1 -V STATE=WPS_SUCCESS > /dev/console &
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/etc/services/svchlper
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
8┆ [ -f /var/servd/$2_stop.sh ] && sh /var/servd/$2_stop.sh > /dev/console
⋮┆----------------------------------------
9┆ xmldbc -P /etc/services/$2.php -V START=/var/servd/$2_start.sh -V
STOP=/var/servd/$2_stop.sh
⋮┆----------------------------------------
10┆ sh /var/servd/$2_start.sh > /dev/console
⋮┆----------------------------------------
12┆ [ "$RET" != "0" ] && rm -f /var/servd/$2_stop.sh
⋮┆----------------------------------------
13┆ exit $RET
⋮┆----------------------------------------
17┆ sh /var/servd/$2_stop.sh > /dev/console
⋮┆----------------------------------------
19┆ rm -f /var/servd/$2_stop.sh
⋮┆----------------------------------------
20┆ exit $RET
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/htdocs/upnp/NOTIFY.Layer3Forwarding.1.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
10┆ xmldbc -P /etc/scripts/upnp/run.NOTIFY-PROPCHANGE.php -V SERVICE=$SVC -V TARGET_PHP=$PHP >
$SCRIPT
⋮┆----------------------------------------
12┆ sh $SCRIPT &
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/htdocs/upnp/NOTIFY.OSInfo.1.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
10┆ xmldbc -P /etc/scripts/upnp/run.NOTIFY-PROPCHANGE.php -V SERVICE=$SVC -V TARGET_PHP=$PHP >
$SCRIPT
⋮┆----------------------------------------
12┆ sh $SCRIPT &
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/htdocs/upnp/NOTIFY.WANCommonInterfaceConfig.1.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
10┆ xmldbc -P /etc/scripts/upnp/run.NOTIFY-PROPCHANGE.php -V SERVICE=$SVC -V TARGET_PHP=$PHP >
$SCRIPT
⋮┆----------------------------------------
12┆ sh $SCRIPT &
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/htdocs/upnp/NOTIFY.WANEthernetLinkConfig.1.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
10┆ xmldbc -P /etc/scripts/upnp/run.NOTIFY-PROPCHANGE.php -V SERVICE=$SVC -V TARGET_PHP=$PHP >
$SCRIPT
⋮┆----------------------------------------
12┆ sh $SCRIPT &
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/htdocs/upnp/NOTIFY.WANIPConnection.1.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
10┆ xmldbc -P /etc/scripts/upnp/run.NOTIFY-PROPCHANGE.php -V SERVICE=$SVC -V TARGET_PHP=$PHP >
$SCRIPT
⋮┆----------------------------------------
12┆ sh $SCRIPT &
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/htdocs/upnp/NOTIFY.WFAWLANConfig.1.sh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
12┆ xmldbc -P /etc/scripts/upnp/run.NOTIFY-WFADEV.php -V SERVICE=$SVC -V TARGET_PHP=$PHP >
$SHFILE
⋮┆----------------------------------------
14┆ sh $SHFILE &
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/usr/sbin/mfc
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
23┆ LANMAC=`echo -e $2 | tr [A-Z] [a-z]`
⋮┆----------------------------------------
24┆ WANMAC=`echo -e $3 | tr [A-Z] [a-z]`
⋮┆----------------------------------------
25┆ HWREV=`echo -e $4 | tr [A-Z] [a-z]`
⋮┆----------------------------------------
29┆ LANMAC2=`echo -e $8 | tr [A-Z] [a-z]`
⋮┆----------------------------------------
36┆ devdata set -e countrycode=$CCODE -e hwrev=$HWREV $DEVDATA -f
⋮┆----------------------------------------
38┆ M1=`echo $LANMAC | cut -d: -f1`
⋮┆----------------------------------------
39┆ M2=`echo $LANMAC | cut -d: -f2`
⋮┆----------------------------------------
40┆ M3=`echo $LANMAC | cut -d: -f3`
⋮┆----------------------------------------
41┆ M4=`echo $LANMAC | cut -d: -f4`
⋮┆----------------------------------------
42┆ M5=`echo $LANMAC | cut -d: -f5`
⋮┆----------------------------------------
43┆ M6=`echo $LANMAC | cut -d: -f6`
⋮┆----------------------------------------
44┆ iwpriv ra0 e2p 04=$M2$M1
⋮┆----------------------------------------
45┆ iwpriv ra0 e2p 06=$M4$M3
⋮┆----------------------------------------
46┆ iwpriv ra0 e2p 08=$M6$M5
⋮┆----------------------------------------
51┆ ubcfg set $UBCFG
⋮┆----------------------------------------
66┆ iwpriv $INF set ATE=ATESTART
⋮┆----------------------------------------
67┆ iwpriv $INF set ATEDA=FF:FF:FF:FF:FF:FF
⋮┆----------------------------------------
68┆ iwpriv $INF set ATETXGI=0
⋮┆----------------------------------------
69┆ iwpriv $INF set ATETXLEN=$7
⋮┆----------------------------------------
70┆ iwpriv $INF set ATETXCNT=1000000
⋮┆----------------------------------------
71┆ iwpriv $INF set ATETXANT=$9
⋮┆----------------------------------------
72┆ iwpriv $INF set ATECHANNEL=$8
⋮┆----------------------------------------
73┆ iwpriv $INF set ATETXMODE=$4
⋮┆----------------------------------------
74┆ iwpriv $INF set ATETXMCS=$5
⋮┆----------------------------------------
75┆ iwpriv $INF set ATETXBW=$6
⋮┆----------------------------------------
76┆ iwpriv $INF set ATETXPOW0=${10}
⋮┆----------------------------------------
77┆ iwpriv $INF set ATETXFREQOFFSET=$3
⋮┆----------------------------------------
78┆ iwpriv $INF set ATEIPG=200
⋮┆----------------------------------------
79┆ iwpriv $INF set ATE=TXFRAME
⋮┆----------------------------------------
84┆ cp /etc/scripts/mfc/RT2860_MFC.dat $DATPATH
❱ external.semgrep-rules.bash.lang.correctness.unquoted-command-substitution-in-command
❰❰ Blocking ❱❱
The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other
separators specified by the IFS variable. You should surround it with double quotes to avoid
splitting the result.
130┆ echo Ver `cat /etc/config/buildver` Build `cat /etc/config/buildno`
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
133┆ [ "$2" != "" ] && devdata get -e $2
/logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extr
act/1179788-3612812.squashfs_v4_le_extract/usr/sbin/phpsh
❱ external.semgrep-rules.bash.lang.correctness.unquoted-variable-expansion-in-command
❰❰ Blocking ❱❱
Variable expansions must be double-quoted so as to prevent being split into multiple pieces
according to whitespace or whichever separator is specified by the IFS variable. If you really wish
to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X
instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper
bash array.
6┆ echo $CMD|sh > /var/run/phpsh-$$.sh
