You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If a set literal is referred to with a lookup value containing references to base documents, the evaluation is incorrect. Specifically it will fail because the lookup value will not have embedded references resolved. As a result, the lookup is performed with the reference itself contained in the lookup value, e.g., in pseudocode: set.contains(["a",1,data.foo[2]) instead of set.contains(["a",1,<value-referred-to-by-data.foo[2]).
For example, below pair1 contains a reference data.foo[2] which refers to a string value in the x.json file.
(master)torin:~/go/src/github.com/open-policy-agent/opa$ ./opa_darwin_amd64 run ~/x.json
OPA 0.2.1-dev (commit f56ae0d, built at 2016-11-14T22:07:08Z)
Run 'help' to see a list of commands.
> v = {["a","b"],["c","d"]}
> x = "d"
> pair1 = [data.foo[2], x]
> pair1
[
"c",
"d"
]
> v[pair1]
undefined
But lookup values that only contain ground values are fine:
> pair2 = ["c", "d"]
> v[pair2]
true
As are lookup values that contain references to virtual docs:
> y = "c"
> pair3 = [y, x]
> v[pair3]
true
As are lookup values that contain variables with bindings:
This change addresses two issues with evaluation of refs to set literals:
1) If the set or lookup value contained references, they were not being
resolved before checking for membership. So for example,
{data.a[0]}.contains("a") would fail even if data.a[0] = "a". This is solved
by simply resolving all references in the set and lookup value before
performing the membership check.
2) Set literals embedded inside other collections were not being evaluated.
For example, [{"a", "b"}] = x, x[0]["a"] would be false. This solved by
refactoring the branch that handles sets to behave more closely to the ones
for arrays and objects.
Fixesopen-policy-agent#149
If a set literal is referred to with a lookup value containing references to base documents, the evaluation is incorrect. Specifically it will fail because the lookup value will not have embedded references resolved. As a result, the lookup is performed with the reference itself contained in the lookup value, e.g., in pseudocode:
set.contains(["a",1,data.foo[2])
instead ofset.contains(["a",1,<value-referred-to-by-data.foo[2])
.For example, below
pair1
contains a referencedata.foo[2]
which refers to a string value in thex.json
file.But lookup values that only contain ground values are fine:
As are lookup values that contain references to virtual docs:
As are lookup values that contain variables with bindings:
The text was updated successfully, but these errors were encountered: