New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
x-pack/filebeat/input/cel: make now global static per evaluation #36107
Conversation
Previously now was static for the life of the program, which corresponded to the life of the input. This could lead to incorrect and surprising times being provided when the global was used. Obtain a now value before starting each evaluation and use it to shadow the CEL now global (and share it with the Go logging to allow correlation between these).
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good.
@@ -896,8 +906,20 @@ func newProgram(ctx context.Context, src, root string, client *http.Client, limi | |||
return prg, nil | |||
} | |||
|
|||
func evalWith(ctx context.Context, prg cel.Program, state map[string]interface{}) (map[string]interface{}, error) { | |||
out, _, err := prg.ContextEval(ctx, map[string]interface{}{root: state}) | |||
func evalWith(ctx context.Context, prg cel.Program, state map[string]interface{}, now time.Time) (map[string]interface{}, error) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Optional idea: this now
parameter could be called evalStart
to help emphasize and explain the change of value done in the shadowing.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think now
is more evocative of what I mean here.
) Previously now was static for the life of the program, which corresponded to the life of the input. This could lead to incorrect and surprising times being provided when the global was used. Obtain a now value before starting each evaluation and use it to shadow the CEL now global (and share it with the Go logging to allow correlation between these). (cherry picked from commit b6c377c)
) (#36134) Previously now was static for the life of the program, which corresponded to the life of the input. This could lead to incorrect and surprising times being provided when the global was used. Obtain a now value before starting each evaluation and use it to shadow the CEL now global (and share it with the Go logging to allow correlation between these). (cherry picked from commit b6c377c) Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
…stic#36107) Previously now was static for the life of the program, which corresponded to the life of the input. This could lead to incorrect and surprising times being provided when the global was used. Obtain a now value before starting each evaluation and use it to shadow the CEL now global (and share it with the Go logging to allow correlation between these).
What does this PR do?
Previously
now
was static for the life of the program, which corresponded to the life of the input. This could lead to incorrect and surprising times being provided when the global was used. Obtain anow
value before starting each evaluation and use it to shadow the CELnow
global (and share it with the Go logging to allow correlation between these).Why is it important?
now
gave a potentially invalid time.Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Author's Checklist
How to test this PR locally
Related issues
Use cases
Screenshots
Logs