mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
fix(rvm): assert every-quantifier results so failing cases don't pass (#765)
The RVM was silently succeeding on `every` quantifiers (and loops nested inside an `every` body) that should have failed. In each case the loop computed a pass/fail into a register that the surrounding query then ignored, so the RVM disagreed with the interpreter. Four related fixes: - compile_every_quantifier: guard the loop result so a failing `every` body makes the rule undefined instead of always succeeding. - resolve_iteration_state: `every` over a non-iterable scalar (number, string, bool, null, undefined) is now undefined, not vacuously true. Only genuinely empty collections stay true; any/forEach are untouched. - a `some ... in` inside an `every` body now guards its loop result, so a `some` that matches nothing fails the current iteration. Top-level rule bodies still rely on context yields and are unaffected. - a hoisted index iteration (`some i` / `arr[i]`) inside an `every` body gets the same guard. Also drop `every` from OPA_TODO_FOLDERS so the interpreter-vs-RVM differential suite covers it, add an OPA_UNSKIP_FOLDERS env override for auditing other still-skipped folders, and add regression cases for every variant above.
This commit is contained in:
Anand Krishnamoorthi
committed by
GitHub
GitHub
parent
9a486c79bf
commit
6ef5e74eb2
+15
-2
@@ -26,7 +26,6 @@ const OPA_TODO_FOLDERS: &[&str] = &[
|
||||
"baseandvirtualdocs",
|
||||
"dataderef",
|
||||
"defaultkeyword",
|
||||
"every",
|
||||
"fix1863",
|
||||
"functions",
|
||||
"partialdocconstants",
|
||||
@@ -102,6 +101,20 @@ fn log_rvm_skip(case_note: &str, folder_name: Option<&str>) {
|
||||
}
|
||||
}
|
||||
|
||||
/// Allows temporarily enabling RVM verification for folders otherwise listed in
|
||||
/// `OPA_TODO_FOLDERS`, without editing the source. Set `OPA_UNSKIP_FOLDERS` to a
|
||||
/// comma-separated list of folder names (e.g. `every,functions`) or `all`.
|
||||
/// Intended for auditing latent RVM bugs in currently-skipped constructs.
|
||||
fn folder_rvm_unskipped(folder: &str) -> bool {
|
||||
match std::env::var("OPA_UNSKIP_FOLDERS") {
|
||||
Ok(list) => {
|
||||
let list = list.trim();
|
||||
list.eq_ignore_ascii_case("all") || list.split(',').any(|f| f.trim() == folder)
|
||||
}
|
||||
Err(_) => false,
|
||||
}
|
||||
}
|
||||
|
||||
fn setup_engine_for_case(case: &TestCase, is_rego_v0_test: bool) -> Result<EngineSetup> {
|
||||
let mut engine = Engine::new();
|
||||
|
||||
@@ -388,7 +401,7 @@ fn run_opa_tests(opa_tests_dir: String, folders: &[String]) -> Result<()> {
|
||||
let folder_name = folder_name_from_path(path_dir);
|
||||
let skip_rvm_for_folder = folder_name
|
||||
.as_deref()
|
||||
.map(|folder| OPA_TODO_FOLDERS.contains(&folder))
|
||||
.map(|folder| OPA_TODO_FOLDERS.contains(&folder) && !folder_rvm_unskipped(folder))
|
||||
.unwrap_or(false);
|
||||
|
||||
if path.is_dir() {
|
||||
|
||||
@@ -44,6 +44,295 @@ cases:
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_body_fails_for_one_element
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
main := result if {
|
||||
every x in [1, 2, 3] {
|
||||
x > 1
|
||||
}
|
||||
result := true
|
||||
}
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_body_fails_for_all_elements
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
main := result if {
|
||||
every x in [1, 2, 3] {
|
||||
x > 100
|
||||
}
|
||||
result := true
|
||||
}
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_used_directly_as_condition_false
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every x in [1, 2, 3] {
|
||||
x > 1
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_used_directly_as_condition_true
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every x in [1, 2, 3] {
|
||||
x > 0
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_over_non_iterable_number_is_undefined
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every x in 42 {
|
||||
x > 1
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_over_non_iterable_string_is_undefined
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every x in "hello" {
|
||||
x == x
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_over_empty_array_is_vacuously_true
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every x in [] {
|
||||
x > 1
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_with_inner_some_matching_nothing_fails
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every c in [1, 2] {
|
||||
some x in []
|
||||
c == x
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_with_inner_some_matching_succeeds
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every c in [1, 2] {
|
||||
some x in [1, 2, 3]
|
||||
c == x
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_with_hoisted_index_matching_nothing_fails
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every c in [1] {
|
||||
some i
|
||||
[2, 3][i] == c
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_with_hoisted_index_matching_succeeds
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every c in [2, 3] {
|
||||
some i
|
||||
[1, 2, 3][i] == c
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_keyval_over_object_succeeds
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every k, v in {"a": 1, "b": 2} {
|
||||
v > 0
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_keyval_over_object_fails
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every k, v in {"a": 1, "b": 2} {
|
||||
v > 1
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_over_set_domain_succeeds
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every x in {1, 2, 3} {
|
||||
x > 0
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_over_empty_object_is_vacuously_true
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every k, v in {} {
|
||||
v > 1
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_over_empty_set_is_vacuously_true
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every x in set() {
|
||||
x > 1
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_over_undefined_domain_is_undefined
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every x in input.missing {
|
||||
x > 0
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_nested_inside_every_succeeds
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every row in [[1, 2], [3, 4]] {
|
||||
every c in row {
|
||||
c > 0
|
||||
}
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: every_nested_inside_every_fails
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
every row in [[1, 2], [3, 0]] {
|
||||
every c in row {
|
||||
c > 0
|
||||
}
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: "#undefined"
|
||||
|
||||
- note: every_with_outer_binding
|
||||
data: {}
|
||||
modules:
|
||||
- |
|
||||
package test
|
||||
allowed if {
|
||||
threshold := 5
|
||||
every x in [6, 7, 8] {
|
||||
x > threshold
|
||||
}
|
||||
}
|
||||
main := allowed
|
||||
query: data.test.main
|
||||
want_result: true
|
||||
|
||||
- note: simple_loop_test
|
||||
data: {}
|
||||
modules:
|
||||
|
||||
Reference in New Issue
Block a user