Repository navigation
util: validate parseArgs negation targets in strict mode - #67086
JoaoMarcos44 wants to merge 5 commits into
Conversation
|
Welcome to Node.js, and thank you for your first contribution! Before review, please take a moment to read:
Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal. |
10ec1ef to
287de8b
Compare
9b0f403 to
1365d32
Compare
When `allowNegative` is enabled in `util.parseArgs()`, `storeOption()` previously stripped the `no-` prefix unconditionally, even when the option itself was explicitly defined in `options` (for example `'no-logfile'` or `'no-warnings'`). Check `!ObjectHasOwn(options, longOption)` before stripping `no-`, matching `checkOptionUsage()`, and avoid negating configured `'string'` options or `'__proto__'` in `strict: false` mode. Fixes: nodejs#67085 Signed-off-by: JoaoMarcos44 <joaomarcosdias444@gmail.com>
1365d32 to
956b79a
Compare
|
As I commented in the issue, I think the existing behavior is expected, intentional, and desired. Having a |
Cover explicit negative options with string or missing destinations. Preserve boolean aliases, tokens, defaults, multiple values, literal string options, and permissive parsing. Refs: nodejs#67085 Signed-off-by: JoaoMarcos44 <joaomarcosdias444@gmail.com> Assisted-by: Codex
Validate the destination of an applied negative option after checking its original declaration and argument. Reject string and undeclared destinations with ERR_PARSE_ARGS_UNKNOWN_OPTION in strict mode. Keep storeOption unchanged to preserve negative boolean aliases and permissive parsing. Fixes: nodejs#67085 Signed-off-by: JoaoMarcos44 <joaomarcosdias444@gmail.com> Assisted-by: Codex
Show strict negation target validation and preserved boolean aliases. Retain permissive parsing behavior and remove the earlier claims about preserving every negative option and prototype pollution. Refs: nodejs#67086 Signed-off-by: JoaoMarcos44 <joaomarcosdias444@gmail.com> Assisted-by: Codex
|
@ljharb I've narrowed this PR in 3d3d676. The change is confined to Added 18 regression and compatibility cases. Local verification against the edited JavaScript module passed all 126 API cases; the base fails the six new regressions. Repository ESLint and whitespace checks passed. The full rebuilt Node CI remains pending; the local test-runner limitation is documented in the description. The issue description and infographic have also been updated to reflect this scope. AI assistance and the verification limits are disclosed in the PR description. |
|
It should not be possible by default with allowNegatives to reject |
|
I think the restriction that declared explicitly negated booleans must not have a declared positive string option when See the code following this line: |
Reject explicit boolean no-* options that target a string option during strict configuration validation, before arguments are tokenized. Keep missing negation targets as usage errors, preserving valid double negation, boolean aliases, and permissive parsing. Check own option names including non-enumerable declarations without reading a negative getter when its own target is absent. Add regression coverage and document the strict configuration contract. Refs: nodejs#67086 Assisted-by: Codex Signed-off-by: JoaoMarcos44 <joaomarcosdias444@gmail.com>
|
Thanks, @shadowspawn and @ljharb. I've updated the PR in cdda2e3b. The explicit The missing-destination check stays in usage validation. Declaring Application-specific logging behavior and normalization remain outside Local verification passed all 167 parseArgs tests, including CLI cases, on Node v22.16.0 and v24.22.1. These runs loaded the edited JavaScript module with the installed runtime's internals; they were not rebuilt Node binaries. Repository ESLint and Markdown lint also passed. A native build and official CI remain pending. |
Check conflicting negative declarations in the existing validation loop and reuse the validated option type. Remove the additional traversal of own property names while retaining the negation usage check. Follow the existing loop's enumeration scope and error ordering. Keep guards for invalid target configurations, update regression coverage, and document the enumerable declaration requirement. Refs: nodejs#67086 Assisted-by: Codex Signed-off-by: JoaoMarcos44 <joaomarcosdias444@gmail.com>
With
strict: trueandallowNegative: true, an explicitly declared negative boolean can overwrite a string option withfalseor write to an undeclared destination. This change validates those cases while preserving supported boolean negation and short aliases.The configuration conflict check runs in the existing per-option validation loop, reusing the validated
optionType. It rejects an enumerable ownno-X: booleandeclaration paired with an ownX: stringoption, even withargs: []. A separate usage check rejects an applied negation whose destination is not a declared boolean. An isolatedno-alphadeclaration can still be negated through--no-no-alpha.storeOption()is unchanged. No new public option, dependency, cache, or abstraction is introduced. The additional pass over own property names has been removed.Compatibility
strict: false,allowNegative: false, valid boolean aliases, tokens, defaults,multiple, and literal negative string options retain their behavior in the covered cases.Validation
linebreak-styleexception), Markdown lint, andgit diff --checkpassed.The full parseArgs test entry point and original common helpers ran against the edited JavaScript module loaded with the installed runtimes' internals. These results are not from a rebuilt Node binary. A native build and the official CI remain pending.
AI assistance: Codex assisted with implementation, tests, review, and documentation.
Fixes: #67085