SC2046 – ShellCheck Wiki

Quote this to prevent word splitting.

Problematic code:

ls -l $(getfilename)

Correct code:

# getfilename outputs 1 file
ls -l "$(getfilename)"

# getfilename outputs multiple files, linefeed separated
getfilename | while IFS='' read -r line
do
    ls -l "$line"
done

Rationale:

When command expansions are unquoted, word splitting and globbing will occur. This often manifests itself by breaking when filenames contain spaces.

Trying to fix it by adding quotes or escapes to the data will not work. Instead, quote the command substitution itself.

If the command substitution outputs multiple pieces of data, use a loop instead.

Exceptions

In rare cases you actually want word splitting, such as in

# shellcheck disable=SC2046
gcc $(pkg-config --libs openssl) client.c

This is because pkg-config outputs -lssl -lcrypto, which you want to break up by spaces into -lssl and -lcrypto.

A bash alternative in these cases is to use read -a for words or mapfile for lines. ksh can also use read -a, or a while read loop for lines. In this case, since pkg-config outputs words, you could use:

# Read words from one line into an array in bash and ksh, then expand each as args
read -ra args < <(pkg-config --libs openssl)
gcc "${args[@]}" client.c # expand as args

# Read lines into an array, then expand each as args
readarray -t file_args < <(find /etc/ -type f | grep some-check)
your-linter.sh "${file_args[@]}" # expand as args

ShellCheck is a static analysis tool for shell scripts. This page is part of its documentation.