fix(scan): reject every --reach-* modifier when --reach is not enabled - #1493
Merged
Conversation
The 'reachability flags require --reach' guard in 'socket scan create' relied on a hand-maintained list of flags that had drifted out of sync: --reach-debug, --reach-detailed-analysis-log-file, --reach-disable-external-tool-checks, and --reach-retain-facts-file were missing, so passing them without --reach silently produced a plain SBOM scan that could be mistaken for a reachability scan. Derive the boolean-flag check from the reachabilityFlags definition instead, so newly added flags are covered automatically. The deprecated no-op --reach-disable-analysis-splitting stays exempt.
Martin Torp (mtorp)
requested a review
from Oskar Haarklou Veileborg (BarrensZeppelin)
August 13, 2026 11:40
Oskar Haarklou Veileborg (BarrensZeppelin)
approved these changes
Aug 14, 2026
Oskar Haarklou Veileborg (BarrensZeppelin)
left a comment
Member
There was a problem hiding this comment.
Nice 🙂
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Running
socket scan create --reach-debug .completes successfully as a plain SBOM scan — no reachability analysis runs, and there is no warning that the flag did nothing. A user can easily believe they have a working reachability scan and ship that report as a reachability assessment.socket scan createalready has a guard ("Reachability analysis flags require --reach to be enabled"), but it relied on a hand-maintained list of flags that had drifted out of sync. Four boolean flags were missing and slipped through silently:--reach-debug--reach-detailed-analysis-log-file--reach-disable-external-tool-checks--reach-retain-facts-fileFix
Derive the boolean-flag portion of the guard from the
reachabilityFlagsdefinition itself (comparing each boolean flag against its declared default), so newly added reach flags are covered automatically instead of relying on the list being kept up to date. The deprecated no-op--reach-disable-analysis-splittingremains exempt on purpose.With this change,
socket scan create --reach-debug .exits non-zero with:Tests
--reach-debugwithout--reachfails.--reach-retain-facts-filewithout--reachfails.--reach-disable-analysis-splittingwithout--reachstill succeeds.cmd-scan-createtests pass;pnpm run checkpasses.