fortify / fcli

fcli is a command-line utility for interacting with various Fortify products
https://fortify.github.io/fcli/
Other
31 stars 17 forks source link

Required ArgGroup combined with DefaultValueProvider not working properly #327

Closed rsenden closed 1 year ago

rsenden commented 1 year ago

This issue was initially discovered while working on #132 and reported as a picocli issue: https://github.com/remkop/picocli/issues/1848. A fix was implemented, however apparently this fix doesn't fully resolve the issue.

As an example, when specifying FCLI_DEFAULT_SSC_USER and FCLI_DEFAULT_SSC_PASSWORD environment variables, the fcli sc-dast session login command successfully recognizes that these required options have been set and thus proceeds with the login operation. However, if the FCLI_SSC_CI_TOKEN environment variable is set (instead of username/password), then fcli complains that no value was specified for a required option.

Debugging this issue shows that the original fix only properly handles default values for options in the first ArgGroup defined in a top-level exclusive ArgGroup. In the example above, we have an exclusive top-level ArgGroup containing two other ArgGroups; one for user credential options, and another for token credential options. Both of these subgroups define required options.

As the user credentials ArgGroup is declared first, default values for user credential options are handled properly, but default values for token credentials are not. If we switch the declaration order of these two exclusive ArgGroups, then default values for token credentials are handled properly, but default values for user credentials are not.

The root cause is that the fix checks the exclusive flag on sub-level ArgGroups, but not on top-level ArgGroups. The previous fix needs to be improved, and the unit test should be improved to verify correct operation in all possible ArgGroup configurations, testing all possible combinations of exclusive and non-exclusive ArgGroups with required and/or optional sub-groups, options and positional parameters, testing correct behavior when providing default values for any or all options in any of the ArgGroups.