Skip to content

Commit e9d3828

Browse files
authored
ast/parser: guard against invalid domains for "some" and "every" (#4548)
These would cause a runtime exception when attempting to parse some internal.member_2() This is due to a technicality in how some x in xs is parsed: `x in xs` will first become `internal.member_2(x, xs)`, and `some internal.member_2(x, xs)` is then further processed. The assumption that there're always two (resp. three for internal.member_3) arguments won't hold if a snippet like the one above is fed into the parser. Thanks to Norbert Szetei of Doyensec, @doyensec, for reporting this. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
1 parent 1af4428 commit e9d3828

File tree

2 files changed

+24
-1
lines changed

2 files changed

+24
-1
lines changed

Diff for: ast/parser.go

+18-1
Original file line numberDiff line numberDiff line change
@@ -897,7 +897,16 @@ func (p *Parser) parseSome() *Expr {
897897
if term := p.parseTermInfixCall(); term != nil {
898898
if call, ok := term.Value.(Call); ok {
899899
switch call[0].String() {
900-
case Member.Name, MemberWithKey.Name: // OK
900+
case Member.Name:
901+
if len(call) != 3 {
902+
p.illegal("illegal domain")
903+
return nil
904+
}
905+
case MemberWithKey.Name:
906+
if len(call) != 4 {
907+
p.illegal("illegal domain")
908+
return nil
909+
}
901910
default:
902911
p.illegal("expected `x in xs` or `x, y in xs` expression")
903912
return nil
@@ -972,9 +981,17 @@ func (p *Parser) parseEvery() *Expr {
972981
}
973982
switch call[0].String() {
974983
case Member.Name: // x in xs
984+
if len(call) != 3 {
985+
p.illegal("illegal domain")
986+
return nil
987+
}
975988
qb.Value = call[1]
976989
qb.Domain = call[2]
977990
case MemberWithKey.Name: // k, v in xs
991+
if len(call) != 4 {
992+
p.illegal("illegal domain")
993+
return nil
994+
}
978995
qb.Key = call[1]
979996
qb.Value = call[2]
980997
qb.Domain = call[3]

Diff for: ast/parser_test.go

+6
Original file line numberDiff line numberDiff line change
@@ -785,6 +785,10 @@ func TestSomeDeclExpr(t *testing.T) {
785785
},
786786
With: []*With{{Value: ArrayTerm(), Target: NewTerm(MustParseRef("input"))}},
787787
}, opts)
788+
789+
assertParseErrorContains(t, "invalid domain (internal.member_2)", "some internal.member_2()", "illegal domain", opts)
790+
assertParseErrorContains(t, "invalid domain (internal.member_3)", "some internal.member_3()", "illegal domain", opts)
791+
788792
}
789793

790794
func TestEvery(t *testing.T) {
@@ -851,6 +855,8 @@ func TestEvery(t *testing.T) {
851855
"unexpected ident token: expected \\n or ; or }\n\tevery x\n", // this asserts that the tail of the error message doesn't contain a hint
852856
)
853857

858+
assertParseErrorContains(t, "invalid domain (internal.member_2)", "every internal.member_2()", "illegal domain", opts)
859+
assertParseErrorContains(t, "invalid domain (internal.member_3)", "every internal.member_3()", "illegal domain", opts)
854860
}
855861

856862
func TestNestedExpressions(t *testing.T) {

0 commit comments

Comments
 (0)