Codestin Search App

v-petrovych · 2026-05-25T11:38:44Z

TL;DR

Three audit-batch PRs that landed in main recently — #7747 (CWE-78 allowExecuteCommand), #7748 (CWE-470 allowCustomChange), #7750 (CWE-22 allowParentDirectoryReferences) — each added a new GlobalConfiguration.builder.define() entry that picocli auto-renders into --help output. None of those PRs updated the byte-exact expectedHelpOutput snapshot in LiquibaseCommandLineTest.groovy. This PR adds the three missing stanzas at the alphabetical positions picocli actually emits.

Captured the stanzas verbatim from a local mvn test -Dtest='LiquibaseCommandLineTest#help output' run; not hand-written, so the wrap points exactly match what picocli renders.

Why this regression wasn't caught at PR-author time

picocli reflects over LiquibaseConfiguration.getRegisteredDefinitions() at CLI startup (see LiquibaseCommandLine.addGlobalArguments line 1203) and adds an OptionSpec per registered definition automatically. Authors of new flags get the --help rendering "for free" without touching CLI code, which is exactly when it's easy to forget there's a downstream snapshot test pinning every byte of that output.

The snapshot is a single ~691-line inline string literal in LiquibaseCommandLineTest, which doesn't show up in IDE call-graphs of GlobalConfiguration.ALLOW_CUSTOM_CHANGE (it's literally just a string). Each of the three authors (same author, three different PRs) missed the linkage three times in a row.

Why it surfaced in CI now, not before

Maven's reactor stops at the first module-level test failure. On the liquibase-pro subtree-sync runs, liquibase-standard's MSSQLDatabaseTest.getTargetUniquenessAttributes_allAuthMethods_produceSameUrl was failing first (the regression fixed in #7756). The reactor never advanced to liquibase-cli, so this fixture gap stayed invisible. After #7756 merged and the subtree-sync was retried, the reactor advanced past liquibase-standard, and LiquibaseCommandLineTest.'help output':854 immediately tripped.

The fix

Three new stanzas inserted at the alphabetical positions picocli emits:

Position	New stanza
Before `--allow-duplicated-changeset-identifiers`	`--allow-custom-change=PARAM` (#7748 / CWE-470)
Between `--allow-duplicated-…` and `--allow-inherit-logical-file-path`	`--allow-execute-command=PARAM` (#7747 / CWE-78)
Between `--allow-inherit-logical-file-path` and `--always-drop-instead-of-replace`	`--allow-parent-directory-references=PARAM` (#7750 / CWE-22)

Alphabetical ordering rationale:

Within allow-*: c < d < e < i < p — so custom-change comes first, parent-directory-references comes last.
allow-* (a-l-l-o-w) < always-* (a-l-w-a-y-s) because l < w at position 2 of the suffix.

Each stanza is the verbatim output of picocli's .usage() renderer for that flag, including picocli's specific line-wrap points. The stanzas are NOT hand-written. Hand-editing risks drifting from picocli's rendering on the next build — capturing them as picocli emits them is the only way to keep this snapshot stable.

Captured-output methodology (for future fixture updates)

For anyone adding a new GlobalConfiguration flag and needing to update this fixture:

Temporarily add new File("target/help-output-actual.txt").text = bytes.toString() to the 'help output' test's when: block.
Run mvn test -Dtest='LiquibaseCommandLineTest#help output' — it'll fail, but target/help-output-actual.txt will contain the full picocli output.
Extract the new flag's stanza from that file verbatim (option header + description + DEFAULT + defaults-file/env-var trailer).
Insert at the alphabetical position in expectedHelpOutput.
Revert the diagnostic line.
Re-run the test to confirm green.

This is the procedure I used to generate this PR.

Test plan

[INFO] Tests run: 115, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS  (liquibase-cli reactor)

Full liquibase-cli reactor passes (115/115 specs across ParameterUtilTest, CommandLineArgumentValueProviderTest, LiquibaseCommandLineProCommandTest, LiquibaseCommandLineTest 40 incl. 'help output', LiquibaseCommandLineThreadingTest, LiquibaseLauncherTest, ProCommandErrorMessageTest).

Things to be aware of

Fixture-only change. No production behaviour change. The three flags themselves (their actual gating logic) were merged via CWE-78: opt-in restricted mode for executeCommand changelog change #7747/CWE-470: opt-in restricted mode for customChange changelog change #7748/CWE-22 deprecation flag: opt-in path containment via liquibase.allowParentDirectoryReferences #7750.
No new tests. This PR adds 71 lines to the existing snapshot literal; it doesn't add new specs. The existing 'help output' spec is the only consumer of expectedHelpOutput.
Forward-looking risk: the same fixture-drift gap will reappear when the remaining audit-batch PRs land in main, because each introduces a new GlobalConfiguration entry:
- CWE-470: opt-in restricted mode for customPrecondition changelog element #7749 (B3 customPrecondition) — updates description of existing ALLOW_CUSTOM_CHANGE, will drift the stanza I added in this PR
- CWE-89: opt-in restricted mode for sqlCheck changelog precondition #7753 (B4 sqlCheck → ALLOW_SQL_PRECONDITION)
- CWE-470: opt-in restricted mode for includeAll resourceFilter and resourceComparator classes #7754 (B5 includeAll filter/comparator → ALLOW_INCLUDE_ALL_CLASSES)
- CWE-22: opt-in restricted mode for absolute and classpath: paths in changelog includes #7755 (B6 absolute/classpath: paths → ALLOW_EXTERNAL_CHANGELOG_PATHS)
Each should ideally include its own fixture update before merging. If any merge without one, a follow-up of this PR's shape will be needed for it. Adding a release-process note / PR-template checkbox to enforce this is filed as a separate TECHOPS follow-up.

Coordination

liquibase-pro#3860 (the subtree-sync PR currently red on this test) will go green on LiquibaseCommandLineTest.'help output' after this PR merges and a follow-up subtree-sync pulls it in.
The remaining red check on Upgrade installer JVM to 17.0.6+10 #3860 (PostgreSQLIntegrationTest.testStatusRunDuringUpdate NPE in AlternateConnectionExecutor.<init>) is a pre-existing test-fixture wiring issue, unrelated to this PR.

PR CWE-78: opt-in restricted mode for executeCommand changelog change #7747 — allowExecuteCommand (the original PR that should have updated the fixture)
PR CWE-470: opt-in restricted mode for customChange changelog change #7748 — allowCustomChange (same)
PR CWE-22 deprecation flag: opt-in path containment via liquibase.allowParentDirectoryReferences #7750 — allowParentDirectoryReferences (same)
PR liquibase/liquibase-pro#3860 — subtree-sync currently red on this fixture gap
CWE-693 follow-up: scope generic JDBC userinfo matcher to authority-position only #7756 — the upstream-most MSSQL regression that was hiding this issue until reactor advanced
Sibling regression-fix tickets: DAT-23090 (PR AbstractPathResourceAccessor: confine path resolution to configured root (CWE-22) #7729 over-restriction), DAT-23093 (PR CWE-693: add generic JDBC userinfo fallback to sanitizeUrl coverage #7740 MSSQL Azure-AD over-strip). Pattern across the three: each May-2026 audit fix that touched externally-observable behaviour introduced a downstream test/fixture gap. Worth a retro on the audit-batch process before the remaining tickets in DAT-23006 land.

Part of the May-2026 OSS credential-handling-and-changelog-injection audit slice (sdou label).

…ree new ALLOW_* flags Three upstream PRs from the May-2026 audit batch each added a new GlobalConfiguration.builder.define() entry that picocli auto-renders into the CLI --help output as a global option, but none of the three PRs updated the byte-exact snapshot fixture in LiquibaseCommandLineTest.expectedHelpOutput. Surfaces in liquibase-pro subtree-sync CI (LiquibaseCommandLineTest.'help output':854) once the sibling MSSQL regression (DAT-23093 / #7756) cleared and the Maven reactor advanced past liquibase-standard into liquibase-cli. Missed PRs (all merged into upstream main, all by the same author): #7747 CWE-78 allowExecuteCommand — declared at GlobalConfiguration:57 #7748 CWE-470 allowCustomChange — declared at GlobalConfiguration:56 #7750 CWE-22 allowParentDirectoryReferences — declared at GlobalConfiguration:58 Add three picocli-rendered stanzas to expectedHelpOutput at the alphabetical insertion points the renderer actually emits (captured verbatim from a local 'mvn test -Dtest=LiquibaseCommandLineTest#help output' run after the missing flags were declared): - --allow-custom-change=PARAM inserted BEFORE --allow-duplicated-changeset-identifiers (alphabetical: 'c' < 'd' within 'allow-*') - --allow-execute-command=PARAM inserted BETWEEN --allow-duplicated-changeset-identifiers and --allow-inherit-logical-file-path (alphabetical: 'd' < 'e' < 'i') - --allow-parent-directory-references=PARAM inserted BETWEEN --allow-inherit-logical-file-path and --always-drop-instead-of-replace (alphabetical: 'i' < 'p' within 'allow-*'; 'allow-*' < 'always-*' since 'l' < 'w' at position 2 of the suffix) Each stanza copies the description text VERBATIM from picocli's .usage() renderer — including picocli's specific line-wrap points, which depend on description length, terminal width assumptions, and where word boundaries fall. Hand-editing the stanzas would risk drifting from picocli's rendering on the next build; capturing them as picocli emits is the only way to keep the snapshot stable. Test: full liquibase-cli reactor passes (115 / 115 specs across ParameterUtilTest, CommandLineArgumentValueProviderTest, LiquibaseCommandLineProCommandTest, LiquibaseCommandLineTest (40 incl. 'help output'), LiquibaseCommandLineThreadingTest, LiquibaseLauncherTest, ProCommandErrorMessageTest). Once this merges and a follow-up subtree-sync pulls it into liquibase-pro, the 'help output' assertion at line 854 of the synced fixture file flips green. Note for the audit-batch follow-up: a similar fixture-drift gap will appear when the remaining open PRs in this batch (#7749 customPrecondition, #7753 sqlCheck, #7754 includeAll filter/comparator classes, #7755 external changelog paths) merge into main, because each declares a new GlobalConfiguration entry. Each of those PRs should ideally include its own LiquibaseCommandLineTest fixture update before merging; if any merge without one, a follow-up of this PR's shape will be needed for it.

coderabbitai · 2026-05-25T11:39:03Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 684cfdac-4eae-4d93-b4a4-c44a7764f924

📥 Commits

Reviewing files that changed from the base of the PR and between 0bff9f7 and 75ac557.

📒 Files selected for processing (1)

liquibase-cli/src/test/groovy/liquibase/integration/commandline/LiquibaseCommandLineTest.groovy

📝 Walkthrough

Walkthrough

The pull request updates LiquibaseCommandLineTest.groovy to verify expanded help text output for three global command-line options: --allow-custom-change, --allow-execute-command, and --allow-parent-directory-references. Each section includes behavior descriptions, defaults, and corresponding configuration keys.

Changes

CLI help text for security-related options

Layer / File(s)	Summary
Expected help output for security options `liquibase-cli/src/test/groovy/liquibase/integration/commandline/LiquibaseCommandLineTest.groovy`	Test assertion `expectedHelpOutput` is expanded with full parameter documentation for three security-related global options, including descriptions of load-time risks, shell command validation, path containment checks, DEFAULT values, and associated defaults-file/environment-variable keys.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

liquibase/liquibase#7748: Introduces the --allow-custom-change global configuration flag and validation logic that this test's expanded help text documents.
liquibase/liquibase#7747: Adds the --allow-execute-command global option and validation that the test now verifies in CLI help output.
liquibase/liquibase#7750: Implements the --allow-parent-directory-references configuration that this test's expanded help text reflects.

Suggested labels

sdou

Suggested reviewers

wwillard7800
filipelautert

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: updating the expectedHelpOutput snapshot for three new ALLOW_* audit flags.
Description check	✅ Passed	The PR description provides comprehensive context including root cause analysis, methodology, test results, and forward-looking risks, though it does not follow the template structure with explicit Impact/Release note/Things to be aware of sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…w allowExternalChangelogPaths flag This PR introduces ALLOW_EXTERNAL_CHANGELOG_PATHS in GlobalConfiguration (allowExternalChangelogPaths=true by default). The help-output snapshot reflects over all registered config definitions, so the new flag appears in --help and the fixture needs the matching block. Block captured byte-exact from picocli's actual --help output. Mirrors the #7760 pattern for the three already-merged ALLOW_* audit flags (this branch's merge from origin/main brought those in; this commit adds the fourth). Note on the UNC double-backslash: the description references the leading '\\' UNC path prefix. In Groovy triple-quoted source the inserted text is escaped as '\\\\' (four source backslashes → two runtime backslashes) so the runtime fixture matches picocli's literal output. The other 35 block lines apply verbatim. LiquibaseCommandLineTest 40/40 green locally.

…put for the new allowIncludeAllClasses flag This PR introduces ALLOW_INCLUDE_ALL_CLASSES in GlobalConfiguration (allowIncludeAllClasses=true by default), governing the includeAll resourceFilter/resourceComparator class-name attributes. The help-output snapshot reflects over all registered config definitions, so the new flag appears in --help and the fixture needs the matching block. Block captured byte-exact from picocli's actual --help output, inserted alphabetically between --allow-execute-command and --allow-inherit-logical- file-path. Mirrors the #7760 pattern for the three already-merged ALLOW_* audit flags (the merge from origin/main brought those in; this commit adds the fourth). LiquibaseCommandLineTest 40/40 green locally.

…w allowSqlPrecondition flag This PR introduces ALLOW_SQL_PRECONDITION in GlobalConfiguration (allowSqlPrecondition=true by default), governing the <sqlCheck> changelog precondition. The help-output snapshot reflects over all registered config definitions, so the new flag appears in --help and the fixture needs the matching block. Block captured byte-exact from picocli's actual --help output, inserted alphabetically after --allow-parent-directory-references and before --always-drop-instead-of-replace. Mirrors the #7760 pattern for the three already-merged ALLOW_* audit flags (merge from origin/main brought those in; this commit adds the fourth). LiquibaseCommandLineTest 40/40 green locally.

v-petrovych requested review from filipelautert and wwillard7800 as code owners May 25, 2026 11:38

v-petrovych requested a deployment to external May 25, 2026 11:38 — with GitHub Actions Waiting

v-petrovych added the sdou label May 25, 2026

v-petrovych requested a deployment to external May 25, 2026 11:38 — with GitHub Actions Waiting

v-petrovych requested a review from abrackx May 25, 2026 11:42

filipelautert approved these changes May 25, 2026

View reviewed changes

v-petrovych merged commit 8ed8669 into liquibase:main May 25, 2026
8 of 12 checks passed

v-petrovych deleted the cli-help-output-fixture-for-audit-allow-flags branch May 25, 2026 13:26

coderabbitai Bot mentioned this pull request May 25, 2026

fix(postgres): preserve PARTITION BY in diff-changelog (#6885) #7759

Open

3 tasks

coderabbitai Bot mentioned this pull request May 28, 2026

CWE-22: opt-in restricted mode for absolute and classpath: paths in changelog includes #7765

Open

coderabbitai Bot mentioned this pull request May 28, 2026

CWE-470: opt-in restricted mode for includeAll resourceFilter and resourceComparator classes #7766

Open

This was referenced May 28, 2026

CWE-89: opt-in restricted mode for sqlCheck changelog precondition #7767

Open

CWE-470: opt-in restricted mode for customPrecondition changelog element #7768

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update LiquibaseCommandLineTest expectedHelpOutput for the three new ALLOW_* audit flags#7760

Update LiquibaseCommandLineTest expectedHelpOutput for the three new ALLOW_* audit flags#7760
v-petrovych merged 1 commit into
liquibase:mainfrom
v-petrovych:cli-help-output-fixture-for-audit-allow-flags

v-petrovych commented May 25, 2026

Uh oh!

coderabbitai Bot commented May 25, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

v-petrovych commented May 25, 2026

TL;DR

Why this regression wasn't caught at PR-author time

Why it surfaced in CI now, not before

The fix

Captured-output methodology (for future fixture updates)

Test plan

Things to be aware of

Coordination

Related

Uh oh!

coderabbitai Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented May 25, 2026 •

edited

Loading