presidentbeef/brakeman · error · ArgumentError

Cannot specify output format if multiple output files specif

Error message

Cannot specify output format if multiple output files specified

What it means

Brakeman decides the report format either from an explicit `-f/--format` option or by inferring one format per `-o/--output` file from its file extension. When you supply an explicit `--output-format` AND more than one output file, `Brakeman.get_output_formats` raises `ArgumentError`, because a single explicit format cannot be reconciled with multiple files that each declare their own extension.

Source

Thrown at lib/brakeman.rb:259

      :parallel_checks => true,
      :parser_timeout => 10,
      :use_prism => true,
      :relative_path => false,
      :report_progress => true,
      :safe_methods => Set.new,
      :show_ignored => false,
      :sql_safe_methods => Set.new,
      :skip_checks => Set.new,
      :skip_vendor => true,
    }
  end

  #Determine output formats based on options[:output_formats]
  #or options[:output_files]
  def self.get_output_formats options
    #Set output format
    if options[:output_format] && options[:output_files] && options[:output_files].size > 1
      raise ArgumentError, "Cannot specify output format if multiple output files specified"
    end
    if options[:output_format]
      get_formats_from_output_format options[:output_format]
    elsif options[:output_files]
      get_formats_from_output_files options[:output_files]
    else
      begin
        self.load_brakeman_dependency 'terminal-table', :allow_fail
        return [:to_s]
      rescue LoadError
        return [:to_json]
      end
    end
  end

  def self.get_formats_from_output_format output_format
    case output_format
    when :html, :to_html

View on GitHub (pinned to 649e678d0a)

Solutions

1. Drop the `-f/--format` flag and let Brakeman infer each file's format from its extension: `brakeman -o report.json -o report.html`.
2. If you need an explicit format, keep exactly one output file: `brakeman -f json -o report.json`.
3. If you need two formats but one has no usable extension, run brakeman twice with separate `-f`/`-o` pairs.
4. If you drive Brakeman programmatically, do not set `:output_format` when `:output_files` has more than one entry.

Example fix

# before
brakeman -f json -o report.json -o report.html   # => ArgumentError

# after (formats inferred from extensions: JSON + HTML)
brakeman -o report.json -o report.html

# Ruby, guard your option hash before Brakeman.run
def sane_output_options!(opts)
  if opts[:output_format] && opts[:output_files] && opts[:output_files].size > 1
    opts.delete(:output_format) # let extensions drive per-file format
    warn 'Dropped :output_format; formats inferred from output file extensions.'
  end
end

begin
  Brakeman.run :app_path => app, :output_format => fmt, :output_files => files
rescue ArgumentError => e
  if e.message.start_with?('Cannot specify output format')
    retry without :output_format
  end
  raise
end

When it happens

Trigger: Running `brakeman -f json -o report.json -o report.html` (one `-f` plus two `-o` flags), or programmatically calling `Brakeman.run :output_format => :to_json, :output_files => ['report.json', 'report.html']` where the files array has more than one element.

Common situations: CI setups that want both a JSON artifact for tooling (e.g. GitLab/GitHub code scanning) and an HTML or SARIF report for humans, where `-f json` was already configured and a second `-o` was added later; wrapper scripts or shared config that always inject a default `--format` on top of user-specified outputs.

Related errors

• Comparison file doesn't exist
• Invalid GitHub repository format
• Could not find specified check#{missing.length > 1 ? 's' : '
• Minimum age must be 1-15 days.
• Invalid format options: #{invalid_options.inspect}

AI-assisted analysis of presidentbeef/brakeman@649e678d0a (2026-08-21). Data as JSON: /api/errors/a4c006a8edafa64f. Report an issue: GitHub.