Kotlin / Kotlin/kotlinx-cli

Incorrect handling of "--" in GNU mode

Open Beginner friendly
#106 0 comments 0 reactions 0 assignees View on GitHub
found-by-fuzzing
Dominant language
Kotlin
Stars
951
Forks
71
PR merge metrics
No merged PRs in 30d

Description

Next entries are considered options when `--` is encountered in GNU mode. However, there is no check to ensure that they exist.
In the following test case:
``` kotlin
val parser = ArgParser("").apply {
argument(ArgType.String, fullName = "")
prefixStyle = ArgParser.OptionPrefixStyle.GNU
}

val args = arrayOf("--")
parser.parse(args)
```
Many results can be considered correct:
- String "--" is interpreted as a delimiter between options and arguments, parsing is successful with no options and no arguments
- String "--" is interpreted as an argument and parsing is successful
- String "--" is interpreted as a start of the option and the parser fails with a descriptive error because no options are registered

In practice though, it throws an `ArrayOutOfBoundsException`.
Bug is found by fuzzing team @ PLAN Lab.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the GNU-mode parsing path in kotlinx-cli and reproduce the issue using the Kotlin snippet in the report with args set to arrayOf("--"). Trace how the delimiter or option-start case handles the missing next entry, then add or update a regression test so parsing no longer throws ArrayOutOfBoundsException and instead follows one of the valid outcomes described.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.