From 5319f3a8c333349e4818a8a3685a17a98d6f6a2e Mon Sep 17 00:00:00 2001
From: firewave <firewave@users.noreply.github.com>
Date: Sat, 30 Mar 2024 09:33:44 +0100
Subject: [PATCH] bail out when `-rule-file` input has an invalid severity

---
 cli/cmdlineparser.cpp      |  5 +++++
 lib/cppcheck.cpp           |  2 +-
 lib/errortypes.cpp         |  1 +
 test/testcmdlineparser.cpp | 30 ++++++++++++++++++++++++++++++
 4 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/cli/cmdlineparser.cpp b/cli/cmdlineparser.cpp
index 852fc789f2c9..2c4f5fcb2948 100644
--- a/cli/cmdlineparser.cpp
+++ b/cli/cmdlineparser.cpp
@@ -1148,6 +1148,11 @@ CmdLineParser::Result CmdLineParser::parseFromArgs(int argc, const char* const a
                             return Result::Fail;
                         }
 
+                        if (rule.severity == Severity::none) {
+                            mLogger.printError("unable to load rule-file '" + ruleFile + "' - a rule has an invalid severity.");
+                            return Result::Fail;
+                        }
+
                         rule.regex = std::make_shared<Regex>(rule.pattern);
                         const std::string regex_err = rule.regex->compile();
                         if (!regex_err.empty()) {
diff --git a/lib/cppcheck.cpp b/lib/cppcheck.cpp
index 70ecbc836e13..fdcb8e542bb4 100644
--- a/lib/cppcheck.cpp
+++ b/lib/cppcheck.cpp
@@ -1169,7 +1169,7 @@ void CppCheck::executeRules(const std::string &tokenlist, const TokenList &list)
     }
 
     for (const Settings::Rule &rule : mSettings.rules) {
-        if (rule.severity == Severity::none || rule.tokenlist != tokenlist)
+        if (rule.tokenlist != tokenlist)
             continue;
 
         if (!mSettings.quiet) {
diff --git a/lib/errortypes.cpp b/lib/errortypes.cpp
index 00345a59f3b7..50622cb48f63 100644
--- a/lib/errortypes.cpp
+++ b/lib/errortypes.cpp
@@ -72,6 +72,7 @@ std::string severityToString(Severity severity)
     throw InternalError(nullptr, "Unknown severity");
 }
 
+// TODO: bail out on invalid severity
 Severity severityFromString(const std::string& severity)
 {
     if (severity.empty())
diff --git a/test/testcmdlineparser.cpp b/test/testcmdlineparser.cpp
index 1715f0ded23d..ee5b654b277a 100644
--- a/test/testcmdlineparser.cpp
+++ b/test/testcmdlineparser.cpp
@@ -350,6 +350,8 @@ class TestCmdlineParser : public TestFixture {
         TEST_CASE(ruleFileUnknownTokenList);
         TEST_CASE(ruleFileInvalidPattern);
         TEST_CASE(ruleFileMissingId);
+        TEST_CASE(ruleFileInvalidSeverity1);
+        TEST_CASE(ruleFileInvalidSeverity2);
 #else
         TEST_CASE(ruleFileNotSupported);
 #endif
@@ -2369,6 +2371,34 @@ class TestCmdlineParser : public TestFixture {
         ASSERT_EQUALS_ENUM(CmdLineParser::Result::Fail, parser->parseFromArgs(3, argv));
         ASSERT_EQUALS("cppcheck: error: unable to load rule-file 'rule.xml' - a rule is lacking an id.\n", logger->str());
     }
+
+    void ruleFileInvalidSeverity1() {
+        REDIRECT;
+        ScopedFile file("rule.xml",
+                        "<rule>\n"
+                        "<pattern>.+</pattern>\n"
+                        "<message>\n"
+                        "<severity/>"
+                        "</message>\n"
+                        "</rule>\n");
+        const char * const argv[] = {"cppcheck", "--rule-file=rule.xml", "file.cpp"};
+        ASSERT_EQUALS_ENUM(CmdLineParser::Result::Fail, parser->parseFromArgs(3, argv));
+        ASSERT_EQUALS("cppcheck: error: unable to load rule-file 'rule.xml' - a rule has an invalid severity.\n", logger->str());
+    }
+
+    void ruleFileInvalidSeverity2() {
+        REDIRECT;
+        ScopedFile file("rule.xml",
+                        "<rule>\n"
+                        "<pattern>.+</pattern>\n"
+                        "<message>\n"
+                        "<severity>none</severity>"
+                        "</message>\n"
+                        "</rule>\n");
+        const char * const argv[] = {"cppcheck", "--rule-file=rule.xml", "file.cpp"};
+        ASSERT_EQUALS_ENUM(CmdLineParser::Result::Fail, parser->parseFromArgs(3, argv));
+        ASSERT_EQUALS("cppcheck: error: unable to load rule-file 'rule.xml' - a rule has an invalid severity.\n", logger->str());
+    }
 #else
     void ruleFileNotSupported() {
         REDIRECT;