Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

topdown/eval: fix 'every' term plugging on save #4775

Merged
merged 2 commits into from
Jun 29, 2022

Conversation

srenatus
Copy link
Contributor

@srenatus srenatus commented Jun 13, 2022

Previously missing plugging could cause unsafe variables in the
PE output.

Now, all terms in the 'every' body should be plugged properly.
The approach taken here is to plug them all, and then fix the
key and val var names of the copied every expression. Those vars
are fresh after the compiler is done with the expression, so
plugging them should never have any effect outside of the rename.

Fixes the first part of #4766

every y in [2] {
y in output
}
}`),
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

☝️ I think we should be able to reorder this properly: If comp = [ 1 | true ] is would come after object.get(...), we'd be fine.

Right now, when checking the output vars of the call, we get nothing because the call is unsafe. However, we also fly through the checks required to add the object.get call to the reordered body, so we'd be getting the same ordering back. However, with the every call, we'll get an error: output is unsafe, because it's never removed from the unsafe set, since it's never part of the output vars of the reordered body.

Previously missing plugging could cause unsafe variables in the
PE output.

Now, all terms in the 'every' body should be plugged properly.
The approach taken here is to plug them all, and then fix the
key and val var names of the copied every expression. Those vars
are fresh after the compiler is done with the expression, so
plugging them should never have any effect outside of the rename.

Signed-off-by: Stephan Renatus <[email protected]>
@srenatus srenatus marked this pull request as ready for review June 17, 2022 11:35
Copy link
Member

@tsandall tsandall left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we're saving the body of every without PE-ing it we need to namespace the variables to avoid conflicts w/ vars from any the callers. Nice find!

Comment on lines +3045 to 3054
for i := range every.Body {
switch t := every.Body[i].Terms.(type) {
case *ast.Term:
every.Body[i].Terms = e.e.bindings.Plug(t)
every.Body[i].Terms = e.e.bindings.PlugNamespaced(t, e.e.caller.bindings)
case []*ast.Term:
for j := range t {
t[j] = e.e.bindings.Plug(t[j])
for j := 1; j < len(t); j++ { // don't plug operator, t[0]
t[j] = e.e.bindings.PlugNamespaced(t[j], e.e.caller.bindings)
}
}
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unrelated to these changes, but it looks like we're only dealing with single terms and calls here. What happens if the body contains an ast.Every? Is there some rewriting that I'm not aware of?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good find. Probably an oversight. I'll look into it later.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@srenatus srenatus merged commit c0c902c into open-policy-agent:main Jun 29, 2022
@srenatus srenatus deleted the sr/topdown/fix-every-pe branch June 29, 2022 06:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants