fix(core): reject unsupported dictionary unpacking in safe_expr - #939
Open
tonghzhang wants to merge 1 commit into
Open
tonghzhang wants to merge 1 commit into
tonghzhang wants to merge 1 commit into
Conversation
Reject ast.Dict unpacking at validation time so unsupported expressions do not silently evaluate using a None key. Cover nested and short-circuited unpacking, and preserve ordinary dictionary literals with None keys. Generated-by: OpenAI Codex
sivakumar-mahalingam
left a comment
There was a problem hiding this comment.
Could we include the original reported reproducer in the regression cases as well?
For example, bool({**{}}) is one of the concrete failures described in this PR, but the current parameterized test only exercises dictionary unpacking directly or through list/boolean nesting. Adding the exact reproducer would also verify that unpacking is rejected when the dictionary appears as an argument to an otherwise allowed builtin call.
It may also be worth including the membership case ('allowed' in {**mapping}) mentioned in the description, so both previously incorrect evaluation paths are explicitly protected against regression.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Condition.safe_expr("bool({**{}})")currently returns true: dictionary unpacking passes validation, but the interpreter treats its AST sentinel as a literalNonekey. Similarly, a membership condition such as'allowed' in {**mapping}silently returns false even whenmappingcontains that key.Changes
Reject unsupported dictionary unpacking when constructing the condition, matching the existing rejection of other unpacking forms. Document the restriction and cover plain, mixed, repeated, nested, and short-circuited unpacking, plus a valid literal
Nonekey.How I tested this
python -m pytest tests/core/test_action.py -q: 160 passed.tests/corerun: 402 passed; four existing graph-rendering tests failed because the local Windows environment has no Graphvizdotexecutable.git diff --checkalso passed.Notes
Prepared with OpenAI Codex assistance; the regression and broader test results above were run locally. The commit includes a
Generated-bytrailer.Checklist