Skip to content

fix(tool_def): reject bare array flags without values#1603

Merged
chaliy merged 1 commit into
mainfrom
2026-05-08-fix-vulnerable-behavior-for-array-flags
May 8, 2026
Merged

fix(tool_def): reject bare array flags without values#1603
chaliy merged 1 commit into
mainfrom
2026-05-08-fix-vulnerable-behavior-for-array-flags

Conversation

@chaliy
Copy link
Copy Markdown
Contributor

@chaliy chaliy commented May 8, 2026

Motivation

  • Bare array-typed flags (--tags) were parsed as present empty arrays ([]) when no value followed, which can let callbacks treat an omitted value as a valid empty array and bypass presence/type checks.
  • The parser needs to preserve the prior malformed-invocation semantics and surface an error for missing array values to avoid trusting absent data.

Description

  • Change consume_array_value in crates/bashkit/src/tool_def.rs to return Err(format!("--{flag_name}: missing value")) when the flag has no following token or the next token is another --flag, instead of returning an empty ArrayInput::Items(Vec::new()).
  • Add two regression tests in the same file: test_parse_flags_array_missing_value_is_error and test_parse_flags_array_missing_value_before_next_flag_is_error which assert the parser errors with "--tags: missing value" for both end-of-args and next-flag cases.
  • Preserve existing parsing behavior for JSON arrays, object-pair groups, and comma-split scalar arrays (only the bare/missing-value case is made an error).

Testing

  • Ran cargo test -p bashkit parse_flags_array_missing_value and the new tests passed.
  • Ran the package test suite (cargo test -p bashkit) as part of validation; the test run completed and the new tests and existing filtered tests did not fail.
  • Added unit tests are in crates/bashkit/src/tool_def.rs and cover the two missing-value scenarios.

Codex Task

@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented May 8, 2026

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
bashkit f2596d6 Commit Preview URL May 08 2026, 09:12 AM

@chaliy chaliy force-pushed the 2026-05-08-fix-vulnerable-behavior-for-array-flags branch from ca0993f to f2596d6 Compare May 8, 2026 09:09
@chaliy chaliy merged commit 13fbddb into main May 8, 2026
34 checks passed
@chaliy chaliy deleted the 2026-05-08-fix-vulnerable-behavior-for-array-flags branch May 8, 2026 09:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant