You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fixing an issue where a non-collection `every`-domain didn’t fail evaluation.
Removing a possible attack surface, where an attacker with the ability to craft portions of the input document could replace a value with an expected collection type, that is known to be processed by an `every`-statement, with a non-collection value and thereby would cause the policy to accept a query that should otherwise be rejected.
Fixes: #6762
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Given an
input
object like this:I made a mistake in how I interpreted the input, and used
every
like this:This is non-sensical, as
input.items["a"]
will return the string"b"
and not a collection, but surprisingly this passed.Not just a runtime issue either, as the this also passes:
I'd expect the
every
keyword to fail evaluation on anything but a valid collection, both at compile time and runtime.The text was updated successfully, but these errors were encountered: