Skip to content

Add support for space separator when auditing CLI options#2096

Open
matlaj wants to merge 1 commit into
aquasecurity:mainfrom
matlaj:matlaj/space_flag_sep
Open

Add support for space separator when auditing CLI options#2096
matlaj wants to merge 1 commit into
aquasecurity:mainfrom
matlaj:matlaj/space_flag_sep

Conversation

@matlaj
Copy link
Copy Markdown

@matlaj matlaj commented May 7, 2026

Ref issue: #2095

This change adds support for auditing --flag value and flag value style command line options.

Previously, CLI options with a space as separator fell through to the bool-flag branch, detecting "true" instead of the actual value.

The key fix is to the separator capture group: = and : are now optional.

To improve readability, capture groups in pttn are now defined separately and later concatenated, with comments providing explanations for their purpose.

Additionally:

  • The separator match is not a capture group anymore: its result was unused
  • Replaced ^\s with the equivalent \S
  • Removed unnecessary trailing *

New test cases verify the change.

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented May 7, 2026

CLA assistant check
All committers have signed the CLA.

@matlaj
Copy link
Copy Markdown
Author

matlaj commented May 7, 2026

Results without and with this PR, using the toy scenario described in the linked GH issue:

Without
$ ./kube-bench run --benchmark=cis-1.12 --group=4.1 --config-dir=./cfg/ -v=3
(...)
I0508 00:30:24.788585   68409 check.go:110] -----   Running check 4.1.1   -----
I0508 00:30:24.798892   68409 check.go:309] Command: "/bin/ps -fC tail"
I0508 00:30:24.798937   68409 check.go:310] Output:
 "UID          PID    PPID  C STIME TTY          TIME CMD\nmate       35411   24916  0 May07 pts/12   00:00:00 tail -f --lines 5 --sleep-interval=4 /dev/null\n"
I0508 00:30:24.799012   68409 check.go:231] Running 1 test_items
I0508 00:30:24.799103   68409 test.go:153] In flagTestItem.findValue true
I0508 00:30:24.799139   68409 test.go:247] Flag '--lines' exists
I0508 00:30:24.799173   68409 check.go:255] Used auditCommand
I0508 00:30:24.799256   68409 check.go:287] Returning from execute on tests: finalOutput &check.testOutput{testResult:false, flagFound:false, actualResult:"UID          PID    PPID  C STIME TTY          TIME CMD\nmate       35411   24916  0 May07 pts/12   00:00:00 tail -f --lines 5 --sleep-interval=4 /dev/null", ExpectedResult:"'--lines' is equal to '5'"}
I0508 00:30:24.799298   68409 check.go:184] Command: "" TestResult: false State: "FAIL" 
I0508 00:30:24.799336   68409 check.go:110] -----   Running check 4.1.2   -----
I0508 00:30:24.809876   68409 check.go:309] Command: "/bin/ps -fC tail"
I0508 00:30:24.809913   68409 check.go:310] Output:
 "UID          PID    PPID  C STIME TTY          TIME CMD\nmate       35411   24916  0 May07 pts/12   00:00:00 tail -f --lines 5 --sleep-interval=4 /dev/null\n"
I0508 00:30:24.809924   68409 check.go:231] Running 1 test_items
I0508 00:30:24.809969   68409 test.go:153] In flagTestItem.findValue 4
I0508 00:30:24.809997   68409 test.go:247] Flag '--sleep-interval' exists
I0508 00:30:24.810007   68409 check.go:255] Used auditCommand
I0508 00:30:24.810039   68409 check.go:287] Returning from execute on tests: finalOutput &check.testOutput{testResult:true, flagFound:false, actualResult:"UID          PID    PPID  C STIME TTY          TIME CMD\nmate       35411   24916  0 May07 pts/12   00:00:00 tail -f --lines 5 --sleep-interval=4 /dev/null", ExpectedResult:"'--sleep-interval' is equal to '4'"}
I0508 00:30:24.810084   68409 check.go:184] Command: "" TestResult: true State: "PASS" 
With
$ ./kube-bench-fix run --benchmark=cis-1.12 --group=4.1 --config-dir=./cfg/ -v=3
(...)
I0508 00:29:13.648643   68039 check.go:110] -----   Running check 4.1.1   -----
I0508 00:29:13.659218   68039 check.go:309] Command: "/bin/ps -fC tail"
I0508 00:29:13.659262   68039 check.go:310] Output:
 "UID          PID    PPID  C STIME TTY          TIME CMD\nmate       35411   24916  0 May07 pts/12   00:00:00 tail -f --lines 5 --sleep-interval=4 /dev/null\n"
I0508 00:29:13.659297   68039 check.go:231] Running 1 test_items
I0508 00:29:13.659364   68039 test.go:168] In flagTestItem.findValue 5
I0508 00:29:13.659400   68039 test.go:262] Flag '--lines' exists
I0508 00:29:13.659434   68039 check.go:255] Used auditCommand
I0508 00:29:13.659482   68039 check.go:287] Returning from execute on tests: finalOutput &check.testOutput{testResult:true, flagFound:false, actualResult:"UID          PID    PPID  C STIME TTY          TIME CMD\nmate       35411   24916  0 May07 pts/12   00:00:00 tail -f --lines 5 --sleep-interval=4 /dev/null", ExpectedResult:"'--lines' is equal to '5'"}
I0508 00:29:13.659527   68039 check.go:184] Command: "" TestResult: true State: "PASS" 
I0508 00:29:13.659544   68039 check.go:110] -----   Running check 4.1.2   -----
I0508 00:29:13.669357   68039 check.go:309] Command: "/bin/ps -fC tail"
I0508 00:29:13.669399   68039 check.go:310] Output:
 "UID          PID    PPID  C STIME TTY          TIME CMD\nmate       35411   24916  0 May07 pts/12   00:00:00 tail -f --lines 5 --sleep-interval=4 /dev/null\n"
I0508 00:29:13.669440   68039 check.go:231] Running 1 test_items
I0508 00:29:13.669494   68039 test.go:168] In flagTestItem.findValue 4
I0508 00:29:13.669528   68039 test.go:262] Flag '--sleep-interval' exists
I0508 00:29:13.669581   68039 check.go:255] Used auditCommand
I0508 00:29:13.669616   68039 check.go:287] Returning from execute on tests: finalOutput &check.testOutput{testResult:true, flagFound:false, actualResult:"UID          PID    PPID  C STIME TTY          TIME CMD\nmate       35411   24916  0 May07 pts/12   00:00:00 tail -f --lines 5 --sleep-interval=4 /dev/null", ExpectedResult:"'--sleep-interval' is equal to '4'"}
I0508 00:29:13.669658   68039 check.go:184] Command: "" TestResult: true State: "PASS" 

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants