Built-in function errors should not turn into undefined if terms requiring evaluation are passed (Var, Ref, etc.) #3680

tsandall · 2021-07-26T23:19:47Z

OPA should return an internal error instead of invoking the built-in function if the operand requires evaluation. The built-in functions assume that operands have been plugged and are grounded so if they receive a type they do not support they return a generic eval_type_error that gets turned into undefined unless strict builtin error checking is enabled. We should improve the evaluator to return an internal error if builtin functions would be run with terms that require evaluation.

Note, this is not really a bug but an improvement that will help better surface bugs in OPA itself.

Before, we had been passing `len(e.terms)` to `saveCall`, thereby sidestepping the checks that would get the output variable into the save set. In the problematic policy, y = f(1) count(y) with f(x) = [] { _ = input } the call to `count(y)` would be mishandled: it would be evaluated, since its arguments aren't in the saveset. Eval would fail because its argument was a variable (see also open-policy-agent#3680) Fixes open-policy-agent#3681. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>

Before, we had been passing `len(e.terms)` to `saveCall`, thereby sidestepping the checks that would get the output variable into the save set. In the problematic policy, y = f(1) count(y) with f(x) = [] { _ = input } the call to `count(y)` would be mishandled: it would be evaluated, since its arguments aren't in the saveset. Eval would fail because its argument was a variable (see also #3680) Fixes #3681. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>

…-agent#3683) Before, we had been passing `len(e.terms)` to `saveCall`, thereby sidestepping the checks that would get the output variable into the save set. In the problematic policy, y = f(1) count(y) with f(x) = [] { _ = input } the call to `count(y)` would be mishandled: it would be evaluated, since its arguments aren't in the saveset. Eval would fail because its argument was a variable (see also open-policy-agent#3680) Fixes open-policy-agent#3681. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>

…-agent#3683) Before, we had been passing `len(e.terms)` to `saveCall`, thereby sidestepping the checks that would get the output variable into the save set. In the problematic policy, y = f(1) count(y) with f(x) = [] { _ = input } the call to `count(y)` would be mishandled: it would be evaluated, since its arguments aren't in the saveset. Eval would fail because its argument was a variable (see also open-policy-agent#3680) Fixes open-policy-agent#3681. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> Signed-off-by: Dolev Farhi <farhi.dolev@gmail.com>

stale · 2022-01-02T03:25:24Z

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.

tsandall added the bug label Jul 26, 2021

tsandall added enhancement and removed bug labels Jul 27, 2021

srenatus mentioned this issue Jul 30, 2021

topdown: use function arity to determine captured output (partial eval) #3683

Merged

tsandall added rego and removed enhancement labels Dec 3, 2021

stale bot added the inactive label Jan 2, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Built-in function errors should not turn into undefined if terms requiring evaluation are passed (Var, Ref, etc.) #3680

Built-in function errors should not turn into undefined if terms requiring evaluation are passed (Var, Ref, etc.) #3680

tsandall commented Jul 26, 2021 •

edited

Loading

stale bot commented Jan 2, 2022

Built-in function errors should not turn into undefined if terms requiring evaluation are passed (Var, Ref, etc.) #3680

Built-in function errors should not turn into undefined if terms requiring evaluation are passed (Var, Ref, etc.) #3680

Comments

tsandall commented Jul 26, 2021 • edited Loading

stale bot commented Jan 2, 2022

tsandall commented Jul 26, 2021 •

edited

Loading