[Bug] --rule silently accepts unrecognised or lowercase rule IDs, masking override findings and exiting 0

Open Beginner friendly
  • Is something wrong?
#1,536 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

@coder-Yash886 is already working on this.

Since Nov 6, 2026.

  • #1540 by @coder-Yash886 — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
cli, security

Research direction

Start in src/cli/args.ts to trace how --rule is parsed, then read src/cli/overrides.ts where findings are filtered and src/cli/help.ts for the documented rule IDs. Check existing CLI tests for rule filtering and invalid arguments. Done means lowercase supported IDs work consistently and unknown IDs produce a clear error instead of a successful empty result.

Written by the indexing model from the issue text.

Description

bug

Summary

In cve-lite overrides, the --rule <id> flag silently accepts unrecognised rule IDs (e.g. --rule OA999, --rule foo) as well as lowercase rule IDs (e.g. --rule oa001).

Instead of rejecting unrecognised rules, src/cli/overrides.ts filters the findings array using exact equality against options.rule:

if (options.rule) {
  findings = findings.filter((f) => f.ruleId === options.rule);
  skipped = skipped.filter((s) => s.ruleId === options.rule);
}

When an invalid or lowercase rule ID is provided:

  1. findings is filtered to empty [].
  2. The CLI prints ✔ No override hygiene issues found.
  3. The command exits with code 0, even when --fail-on is specified and real override violations exist in the project.

This produces a silent false negative in CI workflows (e.g. cve-lite overrides . --rule oa001 --fail-on high), giving developers a false sense of security while severe override hygiene issues remain.

Command used

# In examples/all-scenarios which contains real OA001 findings:
cve-lite examples/all-scenarios overrides --rule oa001 --fail-on high
cve-lite examples/all-scenarios overrides --rule OA999 --fail-on high

Expected behavior

The CLI should validate the --rule argument against supported override hygiene rules (OA001–OA011, PD001–PD002), matching case-insensitively (or normalizing to uppercase), and reject unknown rules with a clear error:

Error: Unknown --rule ID "foo". Valid rules: OA001, OA002, OA003, OA004, OA005, OA006, OA007, OA008, OA009, OA010, OA011, PD001, PD002.

Actual behavior

 Override Hygiene

✔ No override hygiene issues found.

Exit code: 0 (Silent pass, all real findings masked).

Reproduction

  1. Run cve-lite examples/all-scenarios overrides --rule OA001 --fail-on high
    • Correctly outputs 2 HIGH findings and exits with 1.
  2. Run cve-lite examples/all-scenarios overrides --rule oa001 --fail-on high
    • Incorrectly outputs ✔ No override hygiene issues found. and exits with 0.
  3. Run cve-lite examples/all-scenarios overrides --rule OA999 --fail-on high
    • Accepts unknown rule silently, outputs ✔ No override hygiene issues found., and exits with 0.

Relevant files or output

  • src/cli/args.ts (lines 257-264): --rule is read via requireFlagValue without validating against recognized rule IDs.
  • src/cli/overrides.ts (lines 53-58): Filters findings with f.ruleId === options.rule.
  • src/cli/help.ts (line 123): Documents --rule <id> Only run a specific rule (OA001-OA011, PD001-PD002).
Dominant language
TypeScript
Stars
786
Forks
189
Avg merge
3d 10h
Merged PRs (30d)
98

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OWASP/cve-lite-cli

All issues in OWASP/cve-lite-cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.