Skip to content

Test-FeatureFlag: a rule with a null Condition throws an opaque transform error #83

Description

@HeyItsGilbert

Summary

When a rule's Condition is $null (the Condition key is omitted or misspelled),
Test-FeatureFlag passes $null into Test-Condition -Condition. The
ConditionTransformAttribute then calls .GetType() on the null input and throws a
generic binding error that doesn't say which rule is malformed.

Repro

Import-Module Gatekeeper -RequiredVersion 1.0.0

$flag = @{
    Name = 'MyFeature'; DefaultEffect = 'Deny'
    Rules = @(
        # 'Conditions' is not a schema key; stands in for any rule where Condition is null
        @{ Name = 'Allow group'; Effect = 'Allow'; Conditions = @{ Property = 'Region'; Operator = 'Equals'; Value = 'west' } }
    )
}
$props = @{ Region = @{ Type = 'string' } }
Test-FeatureFlag -FeatureFlag $flag -PropertySet $props -Context @{ Region = 'west' }

Actual

Cannot process argument transformation on parameter 'Condition'.
You cannot call a method on a null-valued expression.

Expected

A clear, actionable error naming the offending rule (or fail-closed to DefaultEffect).

Root cause

Classes/FeatureFlag.ps1, ConditionTransformAttribute.Transform():

$item = switch ($inputData.GetType().FullName) {   # $inputData is $null

No null guard. FeatureFlagTransformAttribute.Transform() has the same pattern.
Note [Condition]::new($null) already throws a clear "Data cannot be null." — the
transform just needs to null-guard and defer to it.

Suggested fix

if ($null -eq $inputData) {
    throw [System.ArgumentNullException]::new('Condition',
        "Rule has no Condition. Each rule must define a 'Condition'.")
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions