Usage errors repeat operands and flag values on stderr

Usage errors repeat operands and flag values on stderr

Published as security advisory GHSA-g78x-vpq6-c3w7; the advisory is the public account of this finding.

What

abcd's command-line refusals repeat what was passed. When a sub-command is unknown, or a flag value does not parse, the error message on stderr, and the --json error object on stdout, quotes the operand or the value verbatim, as the command-line framework abcd uses prints it by default. Many of abcd's own refusals did the same.

A value a script, hook or CI step passes through a variable appears unexpanded in that script's own log. The refusal prints it expanded. Stderr and stdout are kept by CI logs and by session transcripts, so a value that was never written to those logs, a token included, can be written there by abcd's error message.

Affected paths

1. The error line and the --json error object for any verb: the command-line framework's usage errors, and abcd refusals that quote an operand, a flag value or a path.
2. abcd build --json and abcd implement step|status|receipt --json write their own refusal document to stdout ahead of the error object. Its reason quoted the record key it was given, a --pace, --sub-agents or --fix-rounds value that did not parse, and the --session it was given whenever opening the shared run for that session was refused: a value that is not a name, or a name that has not joined a run. Any --session value reaches it. It also quoted a --run value that is not a run id and a --restart value that names no lane of the run, and a blank --yielded put the --restart value in the document's lane field.

Affected versions

Every released version up to and including 0.15.1. The behaviour dates from the command line's first release. Patched versions will be set when the release carrying the fix is cut.

Would it exist without abcd?

Not on these routes. The expanded value reaches the kept log only because abcd's refusal repeats it. abcd added it, so abcd fixes it.

Fix

Branch fix/cli-operand-redaction patches both paths:

• Refusals name what was refused by its position, its flag or its role, and the accepted form, instead of repeating it.
• One pass at the error boundary withholds from the error line and the error object any argument the caller typed, in any form a refusal renders it in: quoted, masked, shortened as a path, or cut short. It keeps short arguments, command names, well-formed record and run ids, and paths that exist in the checkout.
• The own refusal document of build and implement names the key, the pace values, the session, the run and the lane by their flag and length, never their text.

Exit codes and the machine-readable error object's shape are unchanged.