address review comments

Signed-off-by: Max Fisher <[email protected]>

cmd/analyze/main.go

@@ -37,7 +37,7 @@ var (
 	offline             = flag.Bool("offline", false, "disables sandbox network access")
 	customSandbox       = flag.String("sandbox-image", "", "override default dynamic analysis sandbox with custom image")
 	customAnalysisCmd   = flag.String("analysis-command", "", "override default dynamic analysis script path (use with custom sandbox image)")
-	straceLogsDir       = flag.String("strace-logs-dir", "", "directory to write strace logs in container, if strace debug log feature is enabled")
+	straceLogsDir       = flag.String("strace-logs-dir", "", "specify directory in container to write strace logs (for -feature 'StraceDebugLogging')")
 	listModes           = flag.Bool("list-modes", false, "prints out a list of available analysis modes")
 	features            = flag.String("features", "", "override features that are enabled/disabled by default")
 	listFeatures        = flag.Bool("list-features", false, "list available features that can be toggled")
@@ -127,11 +127,7 @@ func dynamicAnalysis(ctx context.Context, pkg *pkgmanager.Pkg, resultStores *wor
 		sbOpts = append(sbOpts, sandbox.Image(*customSandbox))
 	}
 
-	if featureflags.StraceDebugLogging.Enabled() {
-		if *straceLogsDir == "" {
-			slog.ErrorContext(ctx, "strace debug logging enabled but no log directory specified")
-			return
-		}
+	if featureflags.StraceDebugLogging.Enabled() && *straceLogsDir != "" {
 		ctx = context.WithValue(ctx, log.StraceDebugLogDirKey, *straceLogsDir)
 	}
 

internal/worker/rundynamic.go

@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"runtime"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/ossf/package-analysis/internal/analysis"
@@ -165,6 +166,7 @@ func openStraceDebugLogFile(ctx context.Context, name string) *os.File {
 
 	var logDir string
 	if v := ctx.Value(log.StraceDebugLogDirKey); v == nil {
+		slog.WarnContext(ctx, "StraceDebugLogging enabled but log dir not set")
 		return nil
 	} else if dirPath, ok := v.(string); !ok {
 		slog.WarnContext(ctx, "non-string value for log.StraceDebugLogDirKey", "value", v)
@@ -187,7 +189,9 @@ func openStraceDebugLogFile(ctx context.Context, name string) *os.File {
 }
 
 func straceDebugLogFilename(pkg *pkgmanager.Pkg, phase analysisrun.DynamicPhase) string {
-	return fmt.Sprintf("strace-%s-%s-%s-%s.log", pkg.EcosystemName(), pkg.Name(), pkg.Version(), phase)
+	filename := fmt.Sprintf("strace-%s-%s-%s-%s.log", pkg.EcosystemName(), pkg.Name(), pkg.Version(), phase)
+	// protect against e.g. a package name that contains a slash
+	return strings.ReplaceAll(filename, string(os.PathSeparator), "-")
 }
 
 func runDynamicAnalysisPhase(ctx context.Context, pkg *pkgmanager.Pkg, sb sandbox.Sandbox, analysisCmd string, phase analysisrun.DynamicPhase, result *DynamicAnalysisResult) error {