My urfave/cli version is

v2.27.5

Checklist

• Are you running the latest v2 release? The list of releases is here.
• Did you check the manual for your release? The v2 manual is here
• Did you perform a search about this problem? Here's the GitHub guide about searching.

Dependency Management

• My project is using go modules.

Describe the bug

If Bash completion is enabled, and the user attempts to tab complete after a double dash (--), it will execute the normal command action.

To reproduce

Describe the steps or code required to reproduce the behavior

main.go

package main

import (
	"os"

	"github.com/urfave/cli/v2"
)

func main() {
	app := &cli.App{
		Name:                 "cli_test",
		EnableBashCompletion: true,
		Action: func(*cli.Context) error {
			os.Create("/tmp/cli_test/TestFile.out")
			return nil
		},
		Flags: []cli.Flag{
			&cli.BoolFlag{
				Name: "verbose",
			},
		},
	}

	if err := app.Run(os.Args); err != nil {
		panic(err)
	}
}

using the v2 zsh_autocomplete

Sourcing it as such in my ~/.zshrc

PROG=cli_test source <path to project>/zsh_autocomplete

mkdir /tmp/cli_test/ && ls /tmp/cli_test

Dir is empty

Try autocomplete

cli_test --<TAB>
# or 
cli_test -- --generate-bash-completion

Check dir

ls /tmp/cli_test

TestFile.out is present

Observed behavior

Due to the double dash (--), the --generate-bash-completion flag was treated as an argument, and the command was executed normally. This behavior is INCREDIBLY DANGEROUS as it can cause premature execution of a command, without even pressing enter!

Expected behavior

There are several ways this could be handled.

The ideal solution would be autocompleting the list of long flags, instead of executing the normal command action
Another solution would be preventing the command from being executed and not autocompleting.

Additional context

This problem was introduced by this PR
#1938

I personally disagree with this PR being marked as a bug instead of a feature, and think that this behavior should be toggleable instead of enabled for all cli applications.

This PR did disable bash autocomplete after a double dash, but introduced a much worse issue, which is executing the command normally...

Want to fix this yourself?

If I find time, I may be willing to fix this myself, but I wanted to report this as soon as possible since this bug could cause severe damage in the worse case scenario.

Run go version and paste its output here

go version go1.23.2 darwin/arm64

Run go env and paste its output here

GO111MODULE=''
GOARCH='arm64'
GOBIN=''
GOCACHE='/Users/aarolieb/Library/Caches/go-build'
GOENV='/Users/aarolieb/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMODCACHE='/Users/aarolieb/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/aarolieb/go'
GOPRIVATE=''
GOPROXY='direct'
GOROOT='/opt/homebrew/Cellar/go/1.23.2/libexec'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='local'
GOTOOLDIR='/opt/homebrew/Cellar/go/1.23.2/libexec/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.23.2'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/aarolieb/Library/Application Support/go/telemetry'
GCCGO='gccgo'
GOARM64='v8.0'
AR='ar'
CC='cc'
CXX='c++'
CGO_ENABLED='1'
GOMOD='/Users/aarolieb/Code/Scripts/cli_test/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/_s/694rx7x90x96jkm795h4tk5h0000gr/T/go-build3647699756=/tmp/go-build -gno-record-gcc-switches -fno-common'