From 26fcdba654802aca09963e93444c8f6c563644b1 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 26 Aug 2026 18:25:35 +0100
Subject: [PATCH] fix(tests): '\$[' is read as the deprecated $[...] arithmetic
 form

security-tests.sh:72 embedded '\\$[{]?' in a double-quoted string. After bash processes the escape this leaves '$[', which is the obsolete arithmetic-expansion syntax, so the file failed to parse. Escaped so a literal dollar reaches the regex, preserving the intended ERE.

Found by an estate-wide shellcheck sweep of 5,111 tracked scripts across 375
repos: 11 files fail to PARSE (SC1073/SC1072). shellcheck stops analysing at
the failure, so everything after it in the file was never checked either.

Verified: shellcheck -S error reports 0 parse errors for the file(s) touched.
---
 tests/security-tests.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/security-tests.sh b/tests/security-tests.sh
index 85de0b4..6663bce 100755
--- a/tests/security-tests.sh
+++ b/tests/security-tests.sh
@@ -69,7 +69,7 @@ for script in ../qubes-setup*.sh; do
         test_assert "${script_name} doesn't contain 'rm -rf /'" "! grep -q 'rm -rf /' \"${script}\""
 
         # Should not have eval of user input without validation
-        test_assert "${script_name} doesn't have unsafe eval" "! grep -E 'eval .*\\$[{]?[a-zA-Z_]+' \"${script}\" | grep -qv '#'"
+        test_assert "${script_name} doesn't have unsafe eval" "! grep -E 'eval .*\\\$[{]?[a-zA-Z_]+' \"${script}\" | grep -qv '#'"
 
         # Should check for dom0
         test_assert "${script_name} checks for dom0" "grep -q 'hostname.*dom0' \"${script}\""