From cbc9a3d434186be0fb8cb29840a7ce703c340f12 Mon Sep 17 00:00:00 2001 From: jdalton Date: Sun, 11 Oct 2026 17:37:20 -0400 Subject: [PATCH 1/2] fix(scanner): preserve option values --- action.yml | 2 +- docs/parameters.md | 26 +++++++- socket_basics/connectors.yaml | 2 +- .../core/connector/socket_tier1/scanner.py | 52 +++++++++++++--- tests/test_socket_tier1_additional_params.py | 60 +++++++++++++++++++ 5 files changed, 130 insertions(+), 12 deletions(-) create mode 100644 tests/test_socket_tier1_additional_params.py diff --git a/action.yml b/action.yml index e9e8319..991be76 100644 --- a/action.yml +++ b/action.yml @@ -429,7 +429,7 @@ inputs: required: false default: "" socket_additional_params: - description: "Additional CLI params for 'socket scan reach' (comma or space separated). Also reads SOCKET_ADDITIONAL_PARAMS" + description: "Additional CLI params for 'socket scan reach'. Separate options with spaces; repeat list-valued flags. A comma before another option is also supported. Also reads SOCKET_ADDITIONAL_PARAMS." required: false default: "" socket_tier_1_enabled: diff --git a/docs/parameters.md b/docs/parameters.md index eb6bade..0d65181 100644 --- a/docs/parameters.md +++ b/docs/parameters.md @@ -716,13 +716,37 @@ socket-basics --socket-tier1 ``` ### `--socket-additional-params SOCKET_ADDITIONAL_PARAMS` -Additional CLI params for 'socket scan reach' (comma or space separated). +Additional CLI params for `socket scan reach`. Separate options with spaces. +For list-valued CLI options, repeat the flag so each value stays attached to +that option. A legacy comma before another option is also accepted. Commas +inside an argument value stay literal, except an unquoted comma followed by a +hyphen is treated as the legacy separator before another option. Quote the +complete value to pass that sequence literally, such as `"value, --text"`. **Example:** ```bash socket-basics --socket-tier1 --socket-additional-params "--view=full,--all" ``` +To exclude directories from Socket Tier 1 manifest discovery and reachability, +use repeated `--exclude-paths` flags. Paths are relative to the Socket scan +working directory, which defaults to the Basics workspace. `tests` matches only +the `tests` directory at that root; use `**/tests` to match it at any depth. This +option affects the Socket Tier 1 CLI scan. It does not configure other Basics +connectors. + +```bash +socket-basics --socket-tier1 --socket-additional-params="--exclude-paths=tests --exclude-paths=fixtures" +``` + +The same value can be set with `SOCKET_ADDITIONAL_PARAMS` or the GitHub Action's +`socket_additional_params` input: + +```yaml +socket_tier_1_enabled: 'true' +socket_additional_params: '--exclude-paths=tests --exclude-paths=fixtures' +``` + ## Notification Options ### Slack diff --git a/socket_basics/connectors.yaml b/socket_basics/connectors.yaml index 392ae84..7d11e55 100644 --- a/socket_basics/connectors.yaml +++ b/socket_basics/connectors.yaml @@ -440,7 +440,7 @@ connectors: default: false - name: socket_additional_params option: --socket-additional-params - description: "Additional CLI params for 'socket scan reach' (comma or space separated). Also reads SOCKET_ADDITIONAL_PARAMS" + description: "Additional CLI params for 'socket scan reach'. Separate options with spaces; repeat list-valued flags. A comma before another option is also supported. Also reads SOCKET_ADDITIONAL_PARAMS." env_variable: SOCKET_ADDITIONAL_PARAMS type: str default: "" diff --git a/socket_basics/core/connector/socket_tier1/scanner.py b/socket_basics/core/connector/socket_tier1/scanner.py index 0175460..7dfb661 100644 --- a/socket_basics/core/connector/socket_tier1/scanner.py +++ b/socket_basics/core/connector/socket_tier1/scanner.py @@ -28,6 +28,43 @@ logger = logging.getLogger(__name__) +def _split_legacy_parameter_separators(raw: str) -> List[str]: + separated: List[str] = [] + quote: Optional[str] = None + escaped: bool = False + index: int = 0 + + while index < len(raw): + char = raw[index] + if escaped: + separated.append(char) + escaped = False + elif char == "\\" and quote != "'": + separated.append(char) + escaped = True + elif quote: + separated.append(char) + if char == quote: + quote = None + elif char in ("'", '"'): + separated.append(char) + quote = char + elif char == ",": + next_index = index + 1 + while next_index < len(raw) and raw[next_index].isspace(): + next_index += 1 + if next_index < len(raw) and raw[next_index] == "-": + separated.append(" ") + index = next_index - 1 + else: + separated.append(char) + else: + separated.append(char) + index += 1 + + return shlex.split("".join(separated)) + + class SocketTier1Scanner(BaseConnector): """Runs the Socket CLI reachability analysis and returns the generated .socket.facts.json @@ -89,15 +126,12 @@ def _parse_additional_params(self) -> List[str]: ) if not raw: return [] - # Allow comma-separated or regular shell splitting - if ',' in raw: - parts = [p.strip() for p in raw.split(',') if p.strip()] - # further split any parts that contain spaces - out: List[str] = [] - for p in parts: - out.extend(shlex.split(p)) - return out - return shlex.split(raw) + try: + return _split_legacy_parameter_separators(raw) + except ValueError as error: + raise ConnectorExecutionError( + f"Invalid socket_additional_params: {error}" + ) from error def scan(self) -> Dict[str, Any]: # Check if Socket Tier 1 reachability scan should be skipped (for Node.js Socket CLI integration). diff --git a/tests/test_socket_tier1_additional_params.py b/tests/test_socket_tier1_additional_params.py new file mode 100644 index 0000000..154bb78 --- /dev/null +++ b/tests/test_socket_tier1_additional_params.py @@ -0,0 +1,60 @@ +import pytest + +from socket_basics.core.connector.base import ConnectorExecutionError +from socket_basics.core.connector.socket_tier1.scanner import SocketTier1Scanner + + +@pytest.mark.parametrize( + ("raw", "expected"), + [ + ("", []), + ( + "--exclude-paths=tests --exclude-paths=fixtures", + ["--exclude-paths=tests", "--exclude-paths=fixtures"], + ), + ( + "--exclude-paths tests --exclude-paths fixtures", + ["--exclude-paths", "tests", "--exclude-paths", "fixtures"], + ), + ( + "--exclude-paths='test data'", + ["--exclude-paths=test data"], + ), + ( + '--exclude-paths="tests,fixtures"', + ["--exclude-paths=tests,fixtures"], + ), + ("--exclude-paths=**/tests", ["--exclude-paths=**/tests"]), + ("--view=full,--all", ["--view=full", "--all"]), + ( + "--exclude-paths=tests,fixtures --view=full, --all " + '--exclude-paths "test data, -literal"', + [ + "--exclude-paths=tests,fixtures", + "--view=full", + "--all", + "--exclude-paths", + "test data, -literal", + ], + ), + ( + '--note="quoted, --option text"', + ["--note=quoted, --option text"], + ), + (r"--note=left\, --option", ["--note=left,", "--option"]), + ], +) +def test_parse_additional_params_preserves_argument_boundaries(raw, expected): + scanner = SocketTier1Scanner({"socket_additional_params": raw}) + + assert scanner._parse_additional_params() == expected + + +def test_parse_additional_params_reports_malformed_shell_quotes(): + scanner = SocketTier1Scanner({"socket_additional_params": '--exclude-paths "tests'}) + + with pytest.raises( + ConnectorExecutionError, + match="Invalid socket_additional_params: No closing quotation", + ): + scanner._parse_additional_params() From d831cb452b88f55000398292c004d601d8c21135 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Wed, 4 Nov 2026 14:17:07 -0600 Subject: [PATCH 2/2] docs: clarify socket parameter behavior change --- CHANGELOG.md | 10 ++++++++++ action.yml | 2 +- docs/parameters.md | 23 ++++++++++++----------- socket_basics/connectors.yaml | 2 +- 4 files changed, 24 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1820ee0..2465ed7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +### Changed + +- **Behavior change:** `socket_additional_params` now uses shell-style, + space-separated arguments and preserves commas within argument values. A + comma acts as a legacy separator only when it is unquoted and followed by a + hyphen (normally another option). Configurations that used commas as general + separators (for example, `--view,full`) must use a space or `=` instead. Repeat + list-valued flags, such as + `--exclude-paths=tests --exclude-paths=fixtures`. + ## [3.4.1] - 2026-10-21 ### Changed diff --git a/action.yml b/action.yml index 991be76..b9a38f3 100644 --- a/action.yml +++ b/action.yml @@ -429,7 +429,7 @@ inputs: required: false default: "" socket_additional_params: - description: "Additional CLI params for 'socket scan reach'. Separate options with spaces; repeat list-valued flags. A comma before another option is also supported. Also reads SOCKET_ADDITIONAL_PARAMS." + description: "Additional CLI params for 'socket scan reach', using shell-style space separation. Commas in values are preserved; only an unquoted comma followed by a hyphen is a legacy separator. Repeat list-valued flags. Also reads SOCKET_ADDITIONAL_PARAMS." required: false default: "" socket_tier_1_enabled: diff --git a/docs/parameters.md b/docs/parameters.md index 0d65181..414f81e 100644 --- a/docs/parameters.md +++ b/docs/parameters.md @@ -716,24 +716,25 @@ socket-basics --socket-tier1 ``` ### `--socket-additional-params SOCKET_ADDITIONAL_PARAMS` -Additional CLI params for `socket scan reach`. Separate options with spaces. -For list-valued CLI options, repeat the flag so each value stays attached to -that option. A legacy comma before another option is also accepted. Commas -inside an argument value stay literal, except an unquoted comma followed by a -hyphen is treated as the legacy separator before another option. Quote the -complete value to pass that sequence literally, such as `"value, --text"`. +Additional CLI params for `socket scan reach`, parsed with shell-style quoting. + +**Behavior change:** Commas no longer act as general argument separators. Use +spaces or `=` between an option and its value (`--view full` or `--view=full`, +not `--view,full`). Commas inside values stay literal. For compatibility, an +unquoted comma followed by another option still separates arguments, as in +`--view=full,--all`. Quote the complete argument to make that sequence literal, +for example `--label="value, --text"`. **Example:** ```bash -socket-basics --socket-tier1 --socket-additional-params "--view=full,--all" +socket-basics --socket-tier1 --socket-additional-params "--view=full --all" ``` To exclude directories from Socket Tier 1 manifest discovery and reachability, -use repeated `--exclude-paths` flags. Paths are relative to the Socket scan +repeat `--exclude-paths` for each value. Paths are relative to the Socket scan working directory, which defaults to the Basics workspace. `tests` matches only -the `tests` directory at that root; use `**/tests` to match it at any depth. This -option affects the Socket Tier 1 CLI scan. It does not configure other Basics -connectors. +the `tests` directory at that root; use `**/tests` to match it at any depth. The +option affects only the Socket Tier 1 CLI scan. ```bash socket-basics --socket-tier1 --socket-additional-params="--exclude-paths=tests --exclude-paths=fixtures" diff --git a/socket_basics/connectors.yaml b/socket_basics/connectors.yaml index 7d11e55..2ddcf6d 100644 --- a/socket_basics/connectors.yaml +++ b/socket_basics/connectors.yaml @@ -440,7 +440,7 @@ connectors: default: false - name: socket_additional_params option: --socket-additional-params - description: "Additional CLI params for 'socket scan reach'. Separate options with spaces; repeat list-valued flags. A comma before another option is also supported. Also reads SOCKET_ADDITIONAL_PARAMS." + description: "Additional CLI params for 'socket scan reach', using shell-style space separation. Commas in values are preserved; only an unquoted comma followed by a hyphen is a legacy separator. Repeat list-valued flags. Also reads SOCKET_ADDITIONAL_PARAMS." env_variable: SOCKET_ADDITIONAL_PARAMS type: str default: ""