Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set literal references are not evaluated correctly #149

Closed
tsandall opened this issue Nov 14, 2016 · 1 comment · Fixed by #162
Closed

Set literal references are not evaluated correctly #149

tsandall opened this issue Nov 14, 2016 · 1 comment · Fixed by #162
Labels

Comments

@tsandall
Copy link
Member

tsandall commented Nov 14, 2016

If a set literal is referred to with a lookup value containing references to base documents, the evaluation is incorrect. Specifically it will fail because the lookup value will not have embedded references resolved. As a result, the lookup is performed with the reference itself contained in the lookup value, e.g., in pseudocode: set.contains(["a",1,data.foo[2]) instead of set.contains(["a",1,<value-referred-to-by-data.foo[2]).

For example, below pair1 contains a reference data.foo[2] which refers to a string value in the x.json file.

(master)torin:~/go/src/github.com/open-policy-agent/opa$ ./opa_darwin_amd64 run ~/x.json
OPA 0.2.1-dev (commit f56ae0d, built at 2016-11-14T22:07:08Z)

Run 'help' to see a list of commands.

> v = {["a","b"],["c","d"]}
> x = "d"
> pair1 = [data.foo[2], x]
> pair1
[
  "c",
  "d"
]
> v[pair1]
undefined

But lookup values that only contain ground values are fine:

> pair2 = ["c", "d"]
> v[pair2]
true

As are lookup values that contain references to virtual docs:

> y = "c"
> pair3 = [y, x]
> v[pair3]
true

As are lookup values that contain variables with bindings:

> a="c", b="d", pair4=[a,b], v[pair4]
+-----+-----+-----------+
|  a  |  b  |   pair4   |
+-----+-----+-----------+
| "c" | "d" | ["c","d"] |
+-----+-----+-----------+
@tsandall tsandall added the bug label Nov 14, 2016
@tsandall
Copy link
Member Author

Also, there's an issue with sets embedded inside other collections:

OPA 0.2.1 (commit b3f62a1, built at 2016-11-23T16:33:13Z)

Run 'help' to see a list of commands.

> x = [{[1,2], [3,4]}], y = [3,4], x[i][y]
false

tsandall added a commit to tsandall/opa that referenced this issue Nov 23, 2016
This change addresses two issues with evaluation of refs to set literals:

1) If the set or lookup value contained references, they were not being
resolved before checking for membership. So for example,
{data.a[0]}.contains("a") would fail even if data.a[0] = "a". This is solved
by simply resolving all references in the set and lookup value before
performing the membership check.

2) Set literals embedded inside other collections were not being evaluated.
For example, [{"a", "b"}] = x, x[0]["a"] would be false. This solved by
refactoring the branch that handles sets to behave more closely to the ones
for arrays and objects.

Fixes open-policy-agent#149
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant