File-not-found produces specific error
Why it matters
A raw ENOENT: no such file or directory, open 'path/to/file' stack trace tells the user the OS error code and the internal call stack — neither of which tells them what they should actually do. CWE-391 (Unchecked Error Condition) applies: the filesystem error is surfaced but not handled into a user-actionable message. When a CLI accepts user-specified file paths as arguments, it must own the responsibility of validating those paths before processing begins. Failing mid-processing — after partial output has already been written — is worse than failing fast at the boundary.
Severity rationale
Low because the error is immediately visible to the user and does not propagate silently — it degrades UX but does not cause data corruption or security exposure.
Remediation
Validate file existence at argument parse time, before any processing starts:
import { existsSync } from 'fs'
function validateFile(filePath: string): void {
if (!existsSync(filePath)) {
console.error(`Error: File not found: ${filePath}`)
console.error('Check the file path and try again.')
process.exit(2)
}
}
// call before any processing
validateFile(opts.input)
In click, use click.Path(exists=True) to get automatic validation with a clean error:
@cli.command()
@click.argument('file', type=click.Path(exists=True))
def lint(file):
"""Lint the specified FILE."""
# click errors before reaching here: "Error: Path 'missing.js' does not exist."
pass
The error message must name the specific path that was not found — generic "file not found" messages that omit the path force users to guess which argument was wrong.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the CLI Quality Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-391 — Unchecked Error Condition
Taxons
History
- 2026-04-18·v1.0.0·Initial import from cli-quality·automated