Skip to content

bug: validateXargs skips validateFlagValue — AllowedValues not enforced #71

@jonchun

Description

@jonchun

Summary

In validateXargs, when a flag has TakesValue, the code advances idx to skip the value but never calls validateFlagValue on it. This means AllowedValues constraints on xargs flags are not enforced.

Location

validator/validator.go:112-133

if flagObj != nil && flagObj.TakesValue {
    idx++
    if idx >= len(args) {
        return &ValidationError{Message: fmt.Sprintf("Flag '%s' requires a value.", flagName)}
    }
    // value at args[idx] is consumed but never validated
}

Compare with validateArgs (line 195-205) which calls validateFlagValue.

Impact

Currently no xargs flags have AllowedValues defined, so this is a latent bug. It would become exploitable if value-restricted flags are added to the xargs manifest.

Suggested Fix

Add validateFlagValue call after consuming the value.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingpriority: lowNice to fix - minor improvement

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions