Command substitution as an argument to xargs(1) is racy

[alejandro-colomar]

For new checks and feature suggestions

• https://www.shellcheck.net/ (i.e. the latest commit) currently gives no useful warnings about this
• I searched through https://github.com/koalaman/shellcheck/issues and didn't find anything related

Here's a snippet or screenshot that shows a potential problem:

#!/bin/bash

set -o pipefail;

find . -type f -print0 \
| xargs -0 pcre2grep -nM -f <(grepc_c -tfp strcpy || true);

Here's what shellcheck currently says:

$ shellcheck -o all script 
$ 

Here's what I wanted to see:

Process substitution as an argument to xargs(1) is racy.
xargs(1) will invoke more than one processes if the argument list is too long. Such processes will race for the output of the process substitution. Quite often, the first process will consume all of the output, and the rest will see an empty file.

A solution could be to use command substitution instead, but that needs changing the command (in this case, I removed the -f option):

#!/bin/bash

set -o pipefail;

find . -type f -print0 \
| xargs -0 pcre2grep -nM "$(grepc_c -tfp strcpy || true)";

Alternatively, use a temporary file:

#!/bin/bash

set -o pipefail;

my_file="$(mktemp -t my_file.XXXXXX)";
grepc_c -tfp strcpy >"$my_file";

find . -type f -print0 \
| xargs -0 pcre2grep -nM -f $my_file;