lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues
Apache License 2.0
780 stars 35 forks source link

Fix #145: cli parsing - handle correctly false value for validator #146

Closed yoavain closed 1 year ago

yoavain commented 1 year ago

Description

When adding a validator boolean flag to command line, the value was ignored, and the validator was activated even if its value was "false".

Types of changes

Note: This does not resolve command-line with typos.

Related Issue

https://github.com/lirantal/lockfile-lint/issues/145

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Checklist:

codecov-commenter commented 1 year ago

Codecov Report

Base: 97.95% // Head: 97.95% // No change to project coverage :thumbsup:

Coverage data is based on head (fcba2a9) compared to base (a29d18b). Patch has no changes to coverable lines.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #146 +/- ## ======================================= Coverage 97.95% 97.95% ======================================= Files 13 13 Lines 342 342 Branches 73 73 ======================================= Hits 335 335 Misses 7 7 ``` Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal)

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

lirantal commented 1 year ago

Thanks @yoavain 👏

Overall looks ok, but I was wondering if this won't cause an issue with the --empty-hostname validator which on falsy value actually enables a stricter check? I'll check the code really quickly myself too but wanted to float that before merging.

So basically referring to this:

        if (!isPassing) {
          if (!packageResolvedURL.host && options && options.emptyHostname) {
            this.debug(`detected empty hostname but allowing because emptyHostname is not false`)
lirantal commented 1 year ago

Anyway, looks ok to me to merge but let me know if you think otherwise.

yoavain commented 1 year ago

@lirantal I think the change only affects the flags in supportedValidators. empty-hostname is not in that map

lirantal commented 1 year ago

You're right, I see it passed in later as the option to the validators. Let's land it then.