Fix type variable leakage in block variables list (issue #1312)

checker/checker.go

@@ -266,6 +266,10 @@ func (c *checker) checkCall(e ast.Expr) {
 		c.checkOptSelect(e)
 		return
 	}
+	if fnName == "cel.@block" {
+		c.checkCelBlock(e)
+		return
+	}
 
 	args := call.Args()
 	// Traverse arguments.
@@ -771,3 +775,29 @@ var (
 		types.UintKind:      "google.protobuf.UInt64Value",
 	}
 )
+
+func (c *checker) checkCelBlock(e ast.Expr) {
+	call := e.AsCall()
+	if len(call.Args()) != 2 {
+		c.errors.unexpectedASTType(e.ID(), c.location(e), "cel.@block", "incorrect argument count")
+		c.setType(e, types.ErrorType)
+		return
+	}
+
+	varsList := call.Args()[0]
+	if varsList.Kind() != ast.ListKind {
+		c.check(varsList)
+	} else {
+		create := varsList.AsList()
+		for _, elem := range create.Elements() {
+			c.check(elem)
+		}
+		c.setType(varsList, types.NewListType(types.DynType))
+	}
+
+	body := call.Args()[1]
+	c.check(body)
+	c.setType(e, c.getType(body))
+
+	c.setReference(e, ast.NewFunctionReference("cel_block_list"))
+}

policy/helper_test.go

@@ -210,6 +210,15 @@ var (
 			: optional.none())))
 	  : optional.of(@index3.format([@index0, @index2])))`,
 		},
+		{
+			name: "empty_list_unification_issue1312",
+			expr: `
+	cel.@block([
+	  [],
+	  ["foo"]],
+	  @index0 + [1])
+			`,
+		},
 	}
 
 	composerUnnestTests = []struct {

policy/testdata/empty_list_unification_issue1312/config.yaml

@@ -0,0 +1 @@
+name: "empty_list_unification_issue1312"

policy/testdata/empty_list_unification_issue1312/policy.yaml

@@ -0,0 +1,9 @@
+name: "empty_list_unification_issue1312"
+rule:
+  variables:
+    - name: "empty_list"
+      expression: "[]"
+    - name: "string_list"
+      expression: "['foo']"
+  match:
+    - output: "variables.empty_list + [1]"

policy/testdata/empty_list_unification_issue1312/tests.yaml

@@ -0,0 +1,8 @@
+description: Issue 1312 simple test
+section:
+  - name: "basic"
+    tests:
+      - name: "test"
+        input: {}
+        output:
+          expr: "[1]"