Repository navigation
fix: reject a parent's Local flag inside a short option group - #2445
Conversation
With UseShortOptionHandling, a flag that is not found as a whole is split into single-rune flags, and each of those was looked up with lookupFlag, which walks the whole command lineage and ignores Local. The normal path uses lookupAppliedFlag, which only sees the command's own flags plus the persistent ones inherited from its ancestors. So `app sub -xd` (and `app sub -d`) silently set a parent's `-d` flag marked Local: true, while `app sub --debug` is rejected with "flag provided but not defined". Use lookupAppliedFlag for the split flags as well.
7c7b2d4 to
24c422e
Compare
Juneezee
left a comment
There was a problem hiding this comment.
I think something went wrong with your rebase and force-push. Please check your commits and changes
24c422e to
7c7b2d4
Compare
|
Heads-up on the noise here: this morning my fork was hit by a git worm that used my credentials to force-push a payload commit ( |
|
@Juneezee you were right, but it wasn't a rebase: a git worm used my credentials this morning to force-push a payload commit over every branch in my fork ( |
…ble-driven Run each argument as its own subtest, and make the subcommand's own -xy group a table row instead of a second block that appends a flag to the built command. Check the exact error with EqualError, read x and y through Destination, and discard the help output that each rejected argument used to print. Move the test next to the other subcommand short option tests and rename it to TestCommand_UseShortOptionHandlingLocalFlagNotInherited to match them. Assisted-by: claude:claude-opus-5-5 Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
This PR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [github.com/urfave/cli/v3](https://github.com/urfave/cli) | require | minor | `v3.10.1` → `v3.14.0` | [](https://securityscorecards.dev/viewer/?uri=github.com/urfave/cli) | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/23) for more information. --- ### Release Notes <details> <summary>urfave/cli (github.com/urfave/cli/v3)</summary> ### [`v3.14.0`](https://github.com/urfave/cli/releases/tag/v3.14.0) [Compare Source](urfave/cli@v3.13.0...v3.14.0) #### What's Changed - chore(deps): bump mkdocs-git-revision-date-localized-plugin from 1.5.4 to 1.6.0 in the python-packages group by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2436](urfave/cli#2436) - fix: set BoolWithInverseFlag in a short option group by [@​lazerg](https://github.com/lazerg) in [#​2440](urfave/cli#2440) - Keep arguments after a bare dash by [@​official-burak](https://github.com/official-burak) in [#​2419](urfave/cli#2419) - fix: handle a multi-byte flag at the end of a short option group by [@​SulimanAbdulrazzaq](https://github.com/SulimanAbdulrazzaq) in [#​2438](urfave/cli#2438) - fix: complete persistent flags in shell completion by [@​sb123sb123](https://github.com/sb123sb123) in [#​2437](urfave/cli#2437) - fix: restore Unwrap on the error returned by Exit by [@​fadiroot](https://github.com/fadiroot) in [#​2444](urfave/cli#2444) - fix: reject a parent's Local flag inside a short option group by [@​fadiroot](https://github.com/fadiroot) in [#​2445](urfave/cli#2445) - fix: report a flag that needs an argument but is not last in a short group by [@​yu2971512385-ui](https://github.com/yu2971512385-ui) in [#​2443](urfave/cli#2443) - Use prefixFor so flag suggestions agree with help on rune count by [@​januththedev](https://github.com/januththedev) in [#​2448](urfave/cli#2448) - fix: reject duplicate flag names by [@​deepakganesh78](https://github.com/deepakganesh78) in [#​2396](urfave/cli#2396) - fix: date a time-only timestamp today when Timezone is not UTC by [@​breken-ai](https://github.com/breken-ai) in [#​2450](urfave/cli#2450) - fix: let a subcommand's command-line value replace a persistent flag's env/file value by [@​breken-ai](https://github.com/breken-ai) in [#​2449](urfave/cli#2449) - Add urfave_cli_no_template build tag by [@​kolyshkin](https://github.com/kolyshkin) in [#​2441](urfave/cli#2441) - fix: skip empty source values for flags that cannot parse them by [@​abo3losh1](https://github.com/abo3losh1) in [#​2451](urfave/cli#2451) #### New Contributors - [@​lazerg](https://github.com/lazerg) made their first contribution in [#​2440](urfave/cli#2440) - [@​official-burak](https://github.com/official-burak) made their first contribution in [#​2419](urfave/cli#2419) - [@​SulimanAbdulrazzaq](https://github.com/SulimanAbdulrazzaq) made their first contribution in [#​2438](urfave/cli#2438) - [@​sb123sb123](https://github.com/sb123sb123) made their first contribution in [#​2437](urfave/cli#2437) - [@​fadiroot](https://github.com/fadiroot) made their first contribution in [#​2444](urfave/cli#2444) - [@​yu2971512385-ui](https://github.com/yu2971512385-ui) made their first contribution in [#​2443](urfave/cli#2443) - [@​januththedev](https://github.com/januththedev) made their first contribution in [#​2448](urfave/cli#2448) - [@​deepakganesh78](https://github.com/deepakganesh78) made their first contribution in [#​2396](urfave/cli#2396) - [@​breken-ai](https://github.com/breken-ai) made their first contribution in [#​2450](urfave/cli#2450) - [@​abo3losh1](https://github.com/abo3losh1) made their first contribution in [#​2451](urfave/cli#2451) **Full Changelog**: <urfave/cli@v3.13.0...v3.14.0> ### [`v3.13.0`](https://github.com/urfave/cli/releases/tag/v3.13.0) [Compare Source](urfave/cli@v3.12.0...v3.13.0) #### What's Changed - Trim the key of a map flag when TrimSpace is set by [@​youdie006](https://github.com/youdie006) in [#​2431](urfave/cli#2431) - Fix inverse bool flag counting with an external counter by [@​jakezwang](https://github.com/jakezwang) in [#​2432](urfave/cli#2432) - feat: add Deprecated field to flags and commands by [@​anandghegde](https://github.com/anandghegde) in [#​2429](urfave/cli#2429) - fix: parse single-rune Unicode flags by [@​znnnnnnn-wil](https://github.com/znnnnnnn-wil) in [#​2434](urfave/cli#2434) #### New Contributors - [@​jakezwang](https://github.com/jakezwang) made their first contribution in [#​2432](urfave/cli#2432) - [@​anandghegde](https://github.com/anandghegde) made their first contribution in [#​2429](urfave/cli#2429) - [@​znnnnnnn-wil](https://github.com/znnnnnnn-wil) made their first contribution in [#​2434](urfave/cli#2434) **Full Changelog**: <urfave/cli@v3.12.0...v3.13.0> ### [`v3.12.0`](https://github.com/urfave/cli/releases/tag/v3.12.0) [Compare Source](urfave/cli@v3.11.0...v3.12.0) #### What's Changed - feat: add Command.ArgValidator for tree-wide argument validation by [@​dearchap](https://github.com/dearchap) in [#​2377](urfave/cli#2377) - Single-value arguments can be marked as required by [@​idelchi](https://github.com/idelchi) in [#​2393](urfave/cli#2393) - docs: clarify that named Arguments are excluded from cmd.Args() by [@​dearchap](https://github.com/dearchap) in [#​2411](urfave/cli#2411) - fix: never run command action on shell completion past a double dash by [@​dearchap](https://github.com/dearchap) in [#​2412](urfave/cli#2412) - chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by [@​app/dependabot](https://github.com/app/dependabot) in [#​2413](urfave/cli#2413) - Support custom FlagStringer for MutuallyExclusiveFlags by [@​SHIVANSHGARG07](https://github.com/SHIVANSHGARG07) in [#​2414](urfave/cli#2414) - Add TextFlag for encoding.TextMarshaler/TextUnmarshaler values by [@​ChrisJr404](https://github.com/ChrisJr404) in [#​2415](urfave/cli#2415) - chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by [@​app/dependabot](https://github.com/app/dependabot) in [#​2416](urfave/cli#2416) - chore(deps): bump the python-packages group with 2 updates by [@​app/dependabot](https://github.com/app/dependabot) in [#​2417](urfave/cli#2417) - Show inherited persistent flags in child help by [@​justadityaraj](https://github.com/justadityaraj) in [#​2421](urfave/cli#2421) - fix: preserve whitespace in positional arguments by [@​lenamonj](https://github.com/lenamonj) in [#​2423](urfave/cli#2423) - fix: preserve whitespace in equals-form flag values by [@​BenYang12](https://github.com/BenYang12) in [#​2425](urfave/cli#2425) - fix: complete subcommand flags after positional arguments by [@​fzlzjerry](https://github.com/fzlzjerry) in [#​2426](urfave/cli#2426) - Fix a year-less timestamp layout losing January 1 by [@​youdie006](https://github.com/youdie006) in [#​2427](urfave/cli#2427) - docs: add go-size-analyzer, module version, and reflection by [@​imsumedhaa](https://github.com/imsumedhaa) in [#​2428](urfave/cli#2428) #### New Contributors - [@​idelchi](https://github.com/idelchi) made their first contribution in [#​2393](urfave/cli#2393) - [@​SHIVANSHGARG07](https://github.com/SHIVANSHGARG07) made their first contribution in [#​2414](urfave/cli#2414) - [@​ChrisJr404](https://github.com/ChrisJr404) made their first contribution in [#​2415](urfave/cli#2415) - [@​justadityaraj](https://github.com/justadityaraj) made their first contribution in [#​2421](urfave/cli#2421) - [@​lenamonj](https://github.com/lenamonj) made their first contribution in [#​2423](urfave/cli#2423) - [@​BenYang12](https://github.com/BenYang12) made their first contribution in [#​2425](urfave/cli#2425) - [@​youdie006](https://github.com/youdie006) made their first contribution in [#​2427](urfave/cli#2427) - [@​imsumedhaa](https://github.com/imsumedhaa) made their first contribution in [#​2428](urfave/cli#2428) **Full Changelog**: <urfave/cli@v3.11.0...v3.12.0> ### [`v3.11.0`](https://github.com/urfave/cli/releases/tag/v3.11.0) [Compare Source](urfave/cli@v3.10.1...v3.11.0) #### What's Changed - fix: correct a typo in the help message for the powershell autocompletion by [@​suzuki-shunsuke](https://github.com/suzuki-shunsuke) in [#​2383](urfave/cli#2383) - Escape backslashes in fish completion descriptions by [@​mahirhir](https://github.com/mahirhir) in [#​2378](urfave/cli#2378) - chore(deps): bump actions/setup-go from 6 to 7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2389](urfave/cli#2389) - chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in the python-packages group by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2391](urfave/cli#2391) - chore(deps): bump actions/setup-python from 6 to 7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2390](urfave/cli#2390) - fix: skip all hidden flags in shell completion, not just bool flags by [@​vidigoat](https://github.com/vidigoat) in [#​2388](urfave/cli#2388) - Fix nil pointer dereference for interface-typed flag values by [@​mrueg](https://github.com/mrueg) in [#​2400](urfave/cli#2400) - Fix index out of range panic when Run is given no arguments by [@​mrueg](https://github.com/mrueg) in [#​2401](urfave/cli#2401) - fix: honor BoolWithInverseFlag DefaultText by [@​fzlzjerry](https://github.com/fzlzjerry) in [#​2403](urfave/cli#2403) - Fix Issue [#​2385](urfave/cli#2385) by [@​BrandonIrizarry](https://github.com/BrandonIrizarry) in [#​2386](urfave/cli#2386) - fix: inherit HideHelpCommand in subcommands by [@​utkarshalpha](https://github.com/utkarshalpha) in [#​2395](urfave/cli#2395) - test: cover Run-with-no-arguments paths ([#​2406](urfave/cli#2406)) by [@​dearchap](https://github.com/dearchap) in [#​2407](urfave/cli#2407) - test: add shell-completion case for hidden BoolWithInverseFlag by [@​dearchap](https://github.com/dearchap) in [#​2408](urfave/cli#2408) - test: fix ineffective mutex error-string assertion and add mirror cases by [@​dearchap](https://github.com/dearchap) in [#​2410](urfave/cli#2410) #### New Contributors - [@​mahirhir](https://github.com/mahirhir) made their first contribution in [#​2378](urfave/cli#2378) - [@​vidigoat](https://github.com/vidigoat) made their first contribution in [#​2388](urfave/cli#2388) - [@​fzlzjerry](https://github.com/fzlzjerry) made their first contribution in [#​2403](urfave/cli#2403) - [@​BrandonIrizarry](https://github.com/BrandonIrizarry) made their first contribution in [#​2386](urfave/cli#2386) - [@​utkarshalpha](https://github.com/utkarshalpha) made their first contribution in [#​2395](urfave/cli#2395) **Full Changelog**: <urfave/cli@v3.10.1...v3.11.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJLaW5kL0RlcGVuZGVuY2llcyJdfQ==--> Reviewed-on: https://altlinux.space/stapler/stplr/pulls/503
What type of PR is this?
What this PR does / why we need it:
With
UseShortOptionHandling, a flag that is not found as a whole is split into single-rune flags. Each of those was looked up withlookupFlag, which walks the wholeLineage()and ignoresLocal. The normal parse path useslookupAppliedFlag, which only sees the command's own flags plus the persistent ones inherited from its ancestors.So with
app sub -xdandapp sub -dare accepted and set the parent'sdebugflag (itsActionnever runs either, since it is not among the child's applied flags), whileapp sub --debugis rejected withflag provided but not defined, asTestLocalFlagErrorasserts.FlagBase.Localdocuments that a Local flag is not applied to subcommands.command_parse.go: uselookupAppliedFlagfor the split single-rune flags, same as the whole-flag path.command_test.go:TestCommand_UseShortOptionHandling_LocalFlagNotInheritedcovers-xd,-dx,-d(all rejected) and checks the subcommand's own short flags still work in a group. It fails onmainand passes with this change; the full suite passes.Note: #2443 also touches this loop (pre-checking every flag of a group). The two changes are independent; if that lands first this is a one-identifier rebase.
Release Notes