[Bug] --search-depth accepts non-integer values, resulting in NaN depth and unbounded recursive directory traversal

Closed Beginner friendly
  • Is something wrong?
#1,526 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

A pull request for this has already been merged.

  • #1535 by @coder-Yash886 — merged

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
cli, security

Research direction

Read src/cli/validate.ts and follow how --batch-size is validated; compare that with how searchDepth is used in src/index.ts and src/scan/single-scan.ts. Check the depth guard in src/utils/file.ts and add or run focused validation tests if present. Done means invalid values such as abc and 1.5 are rejected before scanning, while valid non-negative integers work.

Written by the indexing model from the issue text.

Description

bug

Summary

--search-depth accepts non-integer and non-numeric inputs (such as --search-depth abc, --search-depth 1.5, or --search-depth=foo) without validation.

In src/index.ts and src/scan/single-scan.ts, the search depth is calculated as:

const searchDepth = Math.max(0, Number(options.searchDepth || DEFAULT_SEARCH_DEPTH));

When a non-numeric string is provided, Number(options.searchDepth) evaluates to NaN, making searchDepth equal NaN.

This value is passed down to findFiles(rootDir, names, maxDepth) in src/utils/file.ts, where directory recursion is controlled by:

function walk(currentDir: string, depth: number) {
  if (depth > maxDepth) return;
  // ...

Because depth > NaN evaluates to false for any depth level in JavaScript (e.g. 10 > NaN is false), the recursion guard is completely bypassed. As a result, the scanner performs unbounded directory traversal into nested directory trees, completely ignoring depth limits. In addition, searchDepth: NaN is recorded into the --json report provenance.

While --batch-size is explicitly validated in src/cli/validate.ts (must be a positive integer), --search-depth has no validation in validateOptions.

Environment

  • OS: Linux / macOS / Windows
  • Node.js version: >= 22.0.0
  • Package manager: npm
  • Lockfile type: any
  • CVE Lite CLI version: 1.40.0

Command used

cve-lite . --offline --search-depth abc

Expected behavior

The CLI should validate --search-depth and reject non-negative integer violations before starting the scan, matching the pattern of --batch-size:

Error: --search-depth must be a non-negative integer

Actual behavior

The CLI accepts --search-depth abc silently, sets searchDepth to NaN, bypasses depth limiting in findFiles, and traverses arbitrarily deep nested folders.

Reproduction

  1. In a directory with deeply nested folders (e.g. depth > 4): 
    node dist/index.js . --offline --search-depth abc
  2. Observe that validateOptions does not throw, and files located beyond the default depth 4 are scanned because depth > NaN never terminates recursion early.

Relevant files or output

  • src/cli/validate.ts: --search-depth is missing from validateOptions.
  • src/utils/file.ts (line 22): if (depth > maxDepth) return; fails to terminate when maxDepth is NaN.
  • src/index.ts (line 68) & src/scan/single-scan.ts: searchDepth evaluates to NaN.
Dominant language
TypeScript
Stars
786
Forks
189
Avg merge
3d 10h
Merged PRs (30d)
98

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OWASP/cve-lite-cli

All issues in OWASP/cve-lite-cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.