Skip to content

Refine iteration variable validation in CEL macros. #1096

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
copybara-service merged 1 commit into from
Jun 17, 2026
+117 −17
Merged

Refine iteration variable validation in CEL macros. #1096

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions extensions/src/main/java/dev/cel/extensions/CelComprehensionsExtensions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,9 +479,8 @@ private static Optional<CelExpr> transformMapEntryMacro(

private static CelExpr validatedIterationVariable(
CelMacroExprFactory exprFactory, CelExpr argument) {

CelExpr arg = checkNotNull(argument);
if (arg.exprKind().getKind() != CelExpr.ExprKind.Kind.IDENT) {
if (!isSimpleIdentifier(arg)) {
return reportArgumentError(exprFactory, arg);
} else if (arg.exprKind().ident().name().equals("__result__")) {
return reportAccumulatorOverwriteError(exprFactory, arg);
Expand All @@ -490,6 +489,12 @@ private static CelExpr validatedIterationVariable(
}
}

private static boolean isSimpleIdentifier(CelExpr expr) {
return expr.getKind() == CelExpr.ExprKind.Kind.IDENT
&& !expr.ident().name().isEmpty()
&& !expr.ident().name().startsWith(".");
}

private static CelExpr reportArgumentError(CelMacroExprFactory exprFactory, CelExpr argument) {
return exprFactory.reportError(
CelIssue.formatError(
Expand Down
51 changes: 38 additions & 13 deletions parser/src/main/java/dev/cel/parser/CelStandardMacro.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,9 +122,9 @@ private static Optional<CelExpr> expandAllMacro(
checkNotNull(exprFactory);
checkNotNull(target);
checkArgument(arguments.size() == 2);
CelExpr arg0 = checkNotNull(arguments.get(0));
CelExpr arg0 = validatedIterationVariable(exprFactory, arguments.get(0));
if (arg0.exprKind().getKind() != CelExpr.ExprKind.Kind.IDENT) {
return Optional.of(reportArgumentError(exprFactory, arg0));
return Optional.of(arg0);
}
CelExpr arg1 = checkNotNull(arguments.get(1));
CelExpr accuInit = exprFactory.newBoolLiteral(true);
Expand Down Expand Up @@ -155,9 +155,9 @@ private static Optional<CelExpr> expandExistsMacro(
checkNotNull(exprFactory);
checkNotNull(target);
checkArgument(arguments.size() == 2);
CelExpr arg0 = checkNotNull(arguments.get(0));
CelExpr arg0 = validatedIterationVariable(exprFactory, arguments.get(0));
if (arg0.exprKind().getKind() != CelExpr.ExprKind.Kind.IDENT) {
return Optional.of(reportArgumentError(exprFactory, arg0));
return Optional.of(arg0);
}
CelExpr arg1 = checkNotNull(arguments.get(1));
CelExpr accuInit = exprFactory.newBoolLiteral(false);
Expand Down Expand Up @@ -190,9 +190,9 @@ private static Optional<CelExpr> expandExistsOneMacro(
checkNotNull(exprFactory);
checkNotNull(target);
checkArgument(arguments.size() == 2);
CelExpr arg0 = checkNotNull(arguments.get(0));
CelExpr arg0 = validatedIterationVariable(exprFactory, arguments.get(0));
if (arg0.exprKind().getKind() != CelExpr.ExprKind.Kind.IDENT) {
return Optional.of(reportArgumentError(exprFactory, arg0));
return Optional.of(arg0);
}
CelExpr arg1 = checkNotNull(arguments.get(1));
CelExpr accuInit = exprFactory.newIntLiteral(0);
Expand Down Expand Up @@ -228,12 +228,9 @@ private static Optional<CelExpr> expandMapMacro(
checkNotNull(exprFactory);
checkNotNull(target);
checkArgument(arguments.size() == 2 || arguments.size() == 3);
CelExpr arg0 = checkNotNull(arguments.get(0));
CelExpr arg0 = validatedIterationVariable(exprFactory, arguments.get(0));
if (arg0.exprKind().getKind() != CelExpr.ExprKind.Kind.IDENT) {
return Optional.of(
exprFactory.reportError(
CelIssue.formatError(
exprFactory.getSourceLocation(arg0), "argument is not an identifier")));
return Optional.of(arg0);
}
CelExpr arg1;
CelExpr arg2;
Expand Down Expand Up @@ -276,9 +273,9 @@ private static Optional<CelExpr> expandFilterMacro(
checkNotNull(exprFactory);
checkNotNull(target);
checkArgument(arguments.size() == 2);
CelExpr arg0 = checkNotNull(arguments.get(0));
CelExpr arg0 = validatedIterationVariable(exprFactory, arguments.get(0));
if (arg0.exprKind().getKind() != CelExpr.ExprKind.Kind.IDENT) {
return Optional.of(reportArgumentError(exprFactory, arg0));
return Optional.of(arg0);
}
CelExpr arg1 = checkNotNull(arguments.get(1));
CelExpr accuInit = exprFactory.newList();
Expand All @@ -305,9 +302,37 @@ private static Optional<CelExpr> expandFilterMacro(
exprFactory.newIdentifier(exprFactory.getAccumulatorVarName())));
}

private static CelExpr validatedIterationVariable(
CelMacroExprFactory exprFactory, CelExpr argument) {
CelExpr arg = checkNotNull(argument);
if (!isSimpleIdentifier(arg)) {
return reportArgumentError(exprFactory, arg);
} else if (arg.exprKind().ident().name().equals("__result__")) {
return reportAccumulatorOverwriteError(exprFactory, arg);
} else {
return arg;
}
}

private static boolean isSimpleIdentifier(CelExpr expr) {
return expr.getKind() == CelExpr.ExprKind.Kind.IDENT
&& !expr.ident().name().isEmpty()
&& !expr.ident().name().startsWith(".");
}

private static CelExpr reportArgumentError(CelMacroExprFactory exprFactory, CelExpr argument) {
return exprFactory.reportError(
CelIssue.formatError(
exprFactory.getSourceLocation(argument), "The argument must be a simple name"));
}

private static CelExpr reportAccumulatorOverwriteError(
CelMacroExprFactory exprFactory, CelExpr argument) {
return exprFactory.reportError(
CelIssue.formatError(
exprFactory.getSourceLocation(argument),
String.format(
"The iteration variable %s overwrites accumulator variable",
argument.ident().name())));
}
}
10 changes: 10 additions & 0 deletions parser/src/test/java/dev/cel/parser/CelParserParameterizedTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,6 +245,16 @@ public void parser_errors() {
runTest(PARSER, "1 + $");
runTest(PARSER, "1.all(2, 3)");
runTest(PARSER, "1.exists(2, 3)");
runTest(PARSER, "[].all(__result__, x)");
runTest(PARSER, "[].exists(__result__, x)");
runTest(PARSER, "[].exists_one(__result__, x)");
runTest(PARSER, "[].map(__result__, x, x)");
runTest(PARSER, "[].filter(__result__, x)");
runTest(PARSER, "[].all(.x, x)");
runTest(PARSER, "[].exists(.x, x)");
runTest(PARSER, "[].exists_one(.x, x)");
runTest(PARSER, "[].map(.x, x, x)");
runTest(PARSER, "[].filter(.x, x)");
runTest(PARSER, "1 + +");
runTest(PARSER, "\"\\xFh\"");
runTest(PARSER, "\"\\a\\b\\f\\n\\r\\t\\v\\'\\\"\\\\\\? Illegal escape \\>\"");
Expand Down
64 changes: 62 additions & 2 deletions parser/src/test/resources/parser_errors.baseline
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,66 @@ E: ERROR: <input>:1:10: The argument must be a simple name
| 1.exists(2, 3)
| .........^

I: [].all(__result__, x)
=====>
E: ERROR: <input>:1:8: The iteration variable __result__ overwrites accumulator variable
| [].all(__result__, x)
| .......^

I: [].exists(__result__, x)
=====>
E: ERROR: <input>:1:11: The iteration variable __result__ overwrites accumulator variable
| [].exists(__result__, x)
| ..........^

I: [].exists_one(__result__, x)
=====>
E: ERROR: <input>:1:15: The iteration variable __result__ overwrites accumulator variable
| [].exists_one(__result__, x)
| ..............^

I: [].map(__result__, x, x)
=====>
E: ERROR: <input>:1:8: The iteration variable __result__ overwrites accumulator variable
| [].map(__result__, x, x)
| .......^

I: [].filter(__result__, x)
=====>
E: ERROR: <input>:1:11: The iteration variable __result__ overwrites accumulator variable
| [].filter(__result__, x)
| ..........^

I: [].all(.x, x)
=====>
E: ERROR: <input>:1:9: The argument must be a simple name
| [].all(.x, x)
| ........^

I: [].exists(.x, x)
=====>
E: ERROR: <input>:1:12: The argument must be a simple name
| [].exists(.x, x)
| ...........^

I: [].exists_one(.x, x)
=====>
E: ERROR: <input>:1:16: The argument must be a simple name
| [].exists_one(.x, x)
| ...............^

I: [].map(.x, x, x)
=====>
E: ERROR: <input>:1:9: The argument must be a simple name
| [].map(.x, x, x)
| ........^

I: [].filter(.x, x)
=====>
E: ERROR: <input>:1:12: The argument must be a simple name
| [].filter(.x, x)
| ...........^

I: 1 + +
=====>
E: ERROR: <input>:1:5: mismatched input '+' expecting {'[', '{', '(', '.', '-', '!', 'true', 'false', 'null', NUM_FLOAT, NUM_INT, NUM_UINT, STRING, BYTES, IDENTIFIER}
Expand Down Expand Up @@ -219,7 +279,7 @@ I: [1, 2, 3].map(var, var * var)
E: ERROR: <input>:1:15: reserved identifier: var
| [1, 2, 3].map(var, var * var)
| ..............^
ERROR: <input>:1:15: argument is not an identifier
ERROR: <input>:1:15: The argument must be a simple name
| [1, 2, 3].map(var, var * var)
| ..............^
ERROR: <input>:1:20: reserved identifier: var
Expand Down Expand Up @@ -362,4 +422,4 @@ ERROR: <input>:1:6: unsupported syntax '`'
| .....^
ERROR: <input>:1:9: missing ')' at '<EOF>'
| has(.`.`
| ........^
| ........^
Loading