Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

with keyword causes rule indexer lookups to fail in some cases #1110

Closed
tsandall opened this issue Dec 18, 2018 · 0 comments · Fixed by #1111
Closed

with keyword causes rule indexer lookups to fail in some cases #1110

tsandall opened this issue Dec 18, 2018 · 0 comments · Fixed by #1111
Labels

Comments

@tsandall
Copy link
Member

tsandall commented Dec 18, 2018

Expected Behavior

The rule indexer should correctly incorporate input & data values overridden by the with keyword.

Actual Behavior

The rule indexer is not returning rules that ought to match given certain evaluation contexts.

Steps to Reproduce the Problem

Given the following rego and json, q and r should generate the same value, however, the indexer incorrectly determines that r does not have to be evaluated. As a result, data.foo.r is undefined.

{"bar": "baz"}
package foo

p = x {
    data.bar = x
}

q = x {
    p = x
}

r = x {
    p = x with input as {}
}

Additional Info

It looks like this issue was introduced in 986d82f

@tsandall tsandall added the bug label Dec 18, 2018
tsandall added a commit to tsandall/opa that referenced this issue Dec 18, 2018
In 986d82f we added support for applying the with keyword to the data
document. In the implementation, the ref resolver had to be updated to
check an additional cache. Those changes contained a bug that caused the
ref resolver to exit early and indicate that the ref was undefined if
the cache did not contain a value for the ref (partial or complete).

If the with cache does not contain a value for the ref, the value from
storage ought to be used. These changes just remove the early
exit--which is safe since the rest of the code checks if the value
returned by the with cache is non-nil (and handles the nil case
accordingly).

Fixes open-policy-agent#1110

Signed-off-by: Torin Sandall <[email protected]>
tsandall added a commit that referenced this issue Dec 18, 2018
In 986d82f we added support for applying the with keyword to the data
document. In the implementation, the ref resolver had to be updated to
check an additional cache. Those changes contained a bug that caused the
ref resolver to exit early and indicate that the ref was undefined if
the cache did not contain a value for the ref (partial or complete).

If the with cache does not contain a value for the ref, the value from
storage ought to be used. These changes just remove the early
exit--which is safe since the rest of the code checks if the value
returned by the with cache is non-nil (and handles the nil case
accordingly).

Fixes #1110

Signed-off-by: Torin Sandall <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant