[Bug] --base accepts another flag as its branch name and drops --offline

Open Beginner friendly
  • Is something wrong?
#1,430 1 comment 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 2 days

@vianmangal is already working on this.

Since Oct 27, 2026.

  • #1431 by @vianmangal — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
cli

Research direction

Read the --base branches in src/cli/args.ts around lines 316–330 and compare their value checks with the shared required-value guard mentioned in the issue. Add regression coverage for missing, empty, and flag-shaped values, plus the valid --base main --offline case. Done means invalid values are rejected with an error naming --base, while valid input still enables offline mode.

Written by the indexing model from the issue text.

Description

Summary

--base accepts another flag as its branch name. With the spaced form, a missing branch value silently consumes the following option. For example, --base --offline stores "--offline" in options.prBase and leaves offline mode disabled.

Both parsing and option validation accept this when --fix --create-pr are present. The --base=--offline form also accepts a flag-shaped branch value.

Related: #1381 / #1382 address the same required-value validation pattern for sibling flags. This report covers the remaining --base branches.

Environment

  • OS: macOS 27.0.1, arm64
  • Node.js version: v24.19.0
  • Package manager: npm 11.17.0
  • Lockfile type: Not applicable; reproduced during argument parsing and validation, before lockfile discovery
  • CVE Lite CLI version: 1.40.0, built from main at ff408754310e98245fbe6553c9ff4eb437f814fd

Command used

The CLI argument sequence that triggers the problem is:

cve-lite . --fix --create-pr --base --offline

The reproduction below exercises the parser and validator directly, without applying fixes or creating a PR.

Expected behavior

Reject a missing branch value followed by another flag, with a non-zero exit and an error naming --base, before starting the scan.

Reject a flag-shaped value in the = form as well. Valid input such as --base main --offline should continue to select main and enable offline mode.

Actual behavior

Neither parseArgs nor validateOptions raises an error.

For the spaced form, --offline is consumed as the branch value, so the requested offline advisory mode is lost. The equals form accepts the same invalid branch string.

The probe below confirms the option handling; it does not exercise outbound HTTP requests or the later PR creation step.

Reproduction

From a checkout of the repository:

git checkout ff408754310e98245fbe6553c9ff4eb437f814fd
npm ci
npm run build

node --input-type=module <<'NODE'
import { parseArgs } from './dist/cli/args.js';
import { validateOptions } from './dist/cli/validate.js';

for (const tail of [
  ['--base', '--offline'],
  ['--base=--offline'],
  ['--base', 'main', '--offline'],
]) {
  const argv = ['.', '--fix', '--create-pr', ...tail];
  const { options } = parseArgs(argv);
  await validateOptions(options);
  console.log(JSON.stringify({
    argv,
    prBase: options.prBase,
    offline: options.offline === true,
    validation: 'accepted',
  }));
}
NODE

No project fixture, advisory database or GitHub authentication is needed for this reproduction.

Relevant files or output

The reproduction exits 0 and prints:

{"argv":[".","--fix","--create-pr","--base","--offline"],"prBase":"--offline","offline":false,"validation":"accepted"}
{"argv":[".","--fix","--create-pr","--base=--offline"],"prBase":"--offline","offline":false,"validation":"accepted"}
{"argv":[".","--fix","--create-pr","--base","main","--offline"],"prBase":"main","offline":true,"validation":"accepted"}

Both --base branches in src/cli/args.ts check only !val, so a non-empty string beginning with - passes. validateOptions permits prBase with createPr and does not reject this value.

Suggested fix: use the shared required-value guard from #1382 for both --base forms, with regression coverage for missing, empty and flag-shaped values, plus a valid --base main --offline case.

I would like to work on this fix and the regression tests.

Dominant language
TypeScript
Stars
786
Forks
189
Avg merge
3d 2h
Merged PRs (30d)
96

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OWASP/cve-lite-cli

All issues in OWASP/cve-lite-cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.