flag: prevent BoolWithInverseFlag.String from panicking without a tab by alliasgher · Pull Request #2311 · urfave/cli

alliasgher · 2026-04-13T22:39:46Z

Summary

BoolWithInverseFlag.String() panics with slice bounds out of range [-1:] when FlagStringer returns a string without a tab character.

The code uses strings.Index(out, "\t") and then slices out[i:]. When no tab is present, i is -1 and out[-1:] panics.

Before

// FlagStringer returns a string with no \t (custom stringer, or default
// when flag doesn't implement DocGenerationFlag)
cli.FlagStringer = func(f cli.Flag) string { return "no tab" }
flag.String() // ← panic: slice bounds out of range [-1:]

Fix

Clamp i to 0 when strings.Index returns -1. In that case the entire stringer output is used as the suffix, which is the safest non-panicking behaviour.

Fixes #2303

Checklist

Tests added (TestBoolWithInverseFlagStringNoPanicWithNoTabStringer)
Full test suite passes

When FlagStringer returns a string without a tab character, strings.Index returns -1 and out[-1:] panics with "slice bounds out of range [-1:]". Guard against this by clamping the index to 0 when no tab is found. In that case the entire FlagStringer output is used as the suffix portion of the formatted string, matching the intent of callers who use a custom stringer without the usual tab layout. Fixes urfave#2303 Signed-off-by: alliasgher <[email protected]>

This PR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [github.com/urfave/cli/v3](https://github.com/urfave/cli) | require | minor | `v3.8.0` → `v3.9.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/urfave/cli/badge)](https://securityscorecards.dev/viewer/?uri=github.com/urfave/cli) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/23) for more information. --- ### Release Notes <details> <summary>urfave/cli (github.com/urfave/cli/v3)</summary> ### [`v3.9.0`](https://github.com/urfave/cli/releases/tag/v3.9.0) [Compare Source](urfave/cli@v3.8.0...v3.9.0) #### What's Changed - chore(deps): bump codecov/codecov-action from 5 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#2300](urfave/cli#2300) - chore(deps): bump the python-packages group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2301](urfave/cli#2301) - docs: fix typo by [@acrobatstick](https://github.com/acrobatstick) in [#2299](urfave/cli#2299) - feat: add descriptions for bash and powershell autocompletion by [@gabelluardo](https://github.com/gabelluardo) in [#2298](urfave/cli#2298) - Made command help more consistent by [@markshep-wbg](https://github.com/markshep-wbg) in [#2287](urfave/cli#2287) - Fix:(issue\_2285): correct function and variable naming in fish completion script by [@TimSoethout](https://github.com/TimSoethout) in [#2286](urfave/cli#2286) - fix(ci): update docs after bash completion update by [@gabelluardo](https://github.com/gabelluardo) in [#2307](urfave/cli#2307) - fix: apply SliceFlagSeparator to env var sources by [@lawrence3699](https://github.com/lawrence3699) in [#2309](urfave/cli#2309) - fix: don't print empty line to stderr when Exit message is empty by [@Yanhu007](https://github.com/Yanhu007) in [#2310](urfave/cli#2310) - flag: prevent BoolWithInverseFlag.String from panicking without a tab by [@alliasgher](https://github.com/alliasgher) in [#2311](urfave/cli#2311) - refactor: bash completion script by [@gabelluardo](https://github.com/gabelluardo) in [#2308](urfave/cli#2308) - fix: drop shebang from bash completion template by [@barry3406](https://github.com/barry3406) in [#2317](urfave/cli#2317) - fix: show flag completions when completing a double-dash prefix by [@morozov](https://github.com/morozov) in [#2316](urfave/cli#2316) - fix: parse flags for help subcommand ([#2271](urfave/cli#2271)) by [@barry3406](https://github.com/barry3406) in [#2319](urfave/cli#2319) - fix: show BoolWithInverseFlag aliases in help text by [@wucm667](https://github.com/wucm667) in [#2321](urfave/cli#2321) #### New Contributors - [@gabelluardo](https://github.com/gabelluardo) made their first contribution in [#2298](urfave/cli#2298) - [@markshep-wbg](https://github.com/markshep-wbg) made their first contribution in [#2287](urfave/cli#2287) - [@lawrence3699](https://github.com/lawrence3699) made their first contribution in [#2309](urfave/cli#2309) - [@Yanhu007](https://github.com/Yanhu007) made their first contribution in [#2310](urfave/cli#2310) - [@alliasgher](https://github.com/alliasgher) made their first contribution in [#2311](urfave/cli#2311) - [@barry3406](https://github.com/barry3406) made their first contribution in [#2317](urfave/cli#2317) - [@morozov](https://github.com/morozov) made their first contribution in [#2316](urfave/cli#2316) - [@wucm667](https://github.com/wucm667) made their first contribution in [#2321](urfave/cli#2321) **Full Changelog**: <urfave/cli@v3.8.0...v3.9.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://altlinux.space/stapler/stplr/pulls/432

alliasgher requested a review from a team as a code owner April 13, 2026 22:39

alliasgher mentioned this pull request Apr 13, 2026

BoolWithInverseFlag.String() panics when FlagStringer returns string without tab #2303

Closed

dearchap approved these changes Apr 16, 2026

View reviewed changes

dearchap merged commit bc00bd4 into urfave:main Apr 16, 2026
9 checks passed

alliasgher mentioned this pull request Apr 16, 2026

flag: prevent BoolWithInverseFlag.String from panicking without a tab #2314

Closed

2 tasks done

Navigation Menu

Repository navigation

flag: prevent BoolWithInverseFlag.String from panicking without a tab - #2311

flag: prevent BoolWithInverseFlag.String from panicking without a tab#2311
dearchap merged 1 commit into
urfave:mainfrom
alliasgher:fix-boolwithinverse-string-panic

alliasgher commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

alliasgher commented Apr 13, 2026

Summary

Before

Fix

Checklist

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants