A bash script runs `for f in *.log; do process "$f"; done` in a directory that contains no .log files, and `process` is called once with the literal string `*.log`. Why does bash behave that way, and what are the correct fixes?

## The rule Pathname expansion is a replacement, and bash only performs the replacement if the pattern matches something. From the bash manual: if no matching filenames are found and the `nullglob` option is not set, the word is left unchanged. There is no error, no warning, no empty expansion — the pattern text simply survives into the command's argument list as an ordinary word. That rule turns a `for` loop over a glob into a loop that always runs at least once: ```bash cd "$(mktemp -d)" # empty directory for f in *.log; do echo "processing $f" # prints: processing *.log rm -- "$f" # rm: cannot remove '*.log': No such file or directory done ``` The bug is nasty because it hides. In development the directory always has a file, the loop looks correct, and the failure only appears the first time production hands you an empty directory — often as a confusing downstream error from whatever `process` does with a nonexistent path, or worse, as a tool that interprets the asterisk itself and does something far too broad. ## Fix 1: nullglob ```bash shopt -s nullglob for f in *.log; do process "$f"; done # zero iterations when nothing matches ``` `nullglob` makes an unmatched pattern expand to **nothing** — the word disappears from the command line. For a `for` loop that is exactly right: no matches means no iterations. It has a real hazard, though, and interviewers like it. Because the word vanishes entirely, any command whose argument count matters can silently mutate: ```bash shopt -s nullglob cp *.log /backup/ # becomes: cp /backup/ -> "missing destination file operand" ls *.log # becomes: ls -> lists the WHOLE directory grep ERROR *.log # becomes: grep ERROR -> hangs reading stdin ``` That last one is the classic: a pipeline stage that appears to hang in CI. So `nullglob` is best enabled deliberately and locally, ideally around the loop rather than at the top of a large script whose other commands were written under the default. ## Fix 2: failglob ```bash shopt -s failglob cp *.log /backup/ # bash: no match: *.log -- cp never runs ``` `failglob` makes an unmatched pattern an **error**: bash prints a no-match message and does not execute the command at all. Use it where the absence of files is genuinely a failure — a release script that must find artefacts to upload. Note the interaction with strict mode: the failed expansion means the command never runs, so nothing else in the pipeline gets a chance to mask it. `nullglob` and `failglob` are mutually exclusive in effect; if both are set, `failglob` wins for a non-matching pattern. ## Fix 3: guard the body ```bash for f in *.log; do [[ -e $f ]] || continue # or: [ -e "$f" ] || continue process "$f" done ``` This changes no global state, works in POSIX sh with `[ -e "$f" ]`, and is obvious to a reader who has met the trap before. Use `-e` rather than `-f` if directories or symlinks should count. The one edge it does not cover is a file literally named `*.log`, which is a curiosity rather than a real concern. A fourth option people reach for — `if [ -n "$(ls *.log 2>/dev/null)" ]` — is worse than all three: it forks, it parses `ls` output, and it breaks on filenames containing whitespace. ## Where else the default bites The same rule applies to any unquoted pattern anywhere, not just loops: - `rm -f *.tmp` in a clean directory tries to remove a file called `*.tmp`; `-f` silently swallows it, which is why the bug persists unnoticed for years. - `arr=( *.log )` produces a one-element array holding the pattern, so `${#arr[@]}` is 1 rather than 0. Checking `(( ${#arr[@]} ))` to decide whether files exist requires `nullglob` to be meaningful. - Passing an unmatched pattern onward — to `ssh`, `find`, `docker run` — hands the remote side an asterisk that *it* may expand, which is a security-relevant surprise rather than a cosmetic one. ## Scoping the option change `shopt` is shell state, so setting it in a sourced library changes the caller's behaviour. Two containment patterns are worth knowing: set it in a subshell — `( shopt -s nullglob; files=( *.log ); ... )` — or save and restore explicitly using `shopt -p nullglob`, whose output is a command that restores the previous setting: ```bash prev=$(shopt -p nullglob) # e.g. "shopt -u nullglob" shopt -s nullglob files=( *.log ) eval "$prev" ``` The general lesson generalises past globbing: bash's defaults were chosen for an interactive typist, where leaving the pattern visible is a helpful hint that you mistyped it. In a script, silence about a mismatch is the wrong default, and part of hardening a script is choosing the option that makes the mismatch loud.