You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In some cases, PE has to generate support rules for negated expressions. When it does this, the support rules must be given names. Currently PE uses the outer query ID and the expression index to produce unique names, however, this is not correct when there are multiple solutions. For example:
p { r[x]; not input[x] }
r[1]
r[2]
Assuming the query is p = true then when p is evaluated, the query ID will be 1 (the identifiers are zero-based) and the expression index of the negated expression will be 1 (the indices are also zero-based.) In this case, the current output from PE when support is generated will be something like:
p { not __not1_1__ }
p { not __not1_1__ }
__not1_1__ { input[1] }
__not1_1__ { input[2] }
The problem of course is that this output is incorrect. p should be true if not input[1] OR not input[2].
To resolve this issue we can encode the negated query ID into the support rule name, e.g:
p { not __not_1_1_3__ }
p { not __not_1_1_5__ }
__not1_1_3__ { input[1] }
__not1_1_5__ { input[2] }
The text was updated successfully, but these errors were encountered:
Previously OPA was only using the outer query ID and expression index
to namespace support rules. However, this was incorrect if the same
expression was evaluated multiple times due to iteration. This commit
fixes the issue by including the query ID of the complemented
expression in the rule name suffix.
Fixesopen-policy-agent#2491
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
In some cases, PE has to generate support rules for negated expressions. When it does this, the support rules must be given names. Currently PE uses the outer query ID and the expression index to produce unique names, however, this is not correct when there are multiple solutions. For example:
Assuming the query is
p = true
then whenp
is evaluated, the query ID will be 1 (the identifiers are zero-based) and the expression index of the negated expression will be 1 (the indices are also zero-based.) In this case, the current output from PE when support is generated will be something like:The problem of course is that this output is incorrect.
p
should be true ifnot input[1]
ORnot input[2]
.To resolve this issue we can encode the negated query ID into the support rule name, e.g:
The text was updated successfully, but these errors were encountered: