Repository navigation
fix(azure_policy): index only all-digit subscripts and saturate overflow - #869
Merged
Anand Krishnamoorthi (anakrish) merged 3 commits intoOct 27, 2026
Conversation
u64 parsing accepted a leading '+', so a[+1] silently became index 1. Pin the remaining splitter edge cases: empty quoted keys error, lone quotes stay literal keys, leading zeros still index, and bracket whitespace is trimmed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…n keys Dotted numeric segments are keys, so properties.ipRules.1.value no longer indexes the array (previously audited). Also run quoted numeric keys through the existenceCondition lookup path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
A bare all-digit subscript that does not fit in u64, such as properties.config[18446744073709551616], fell back to an object key and read config["18446744073709551616"], contradicting the rule that only quoted subscripts are keys. Saturate it to u64::MAX instead: the index is out of range on any array and never matches an object key, so the field is Undefined. The quoted form is still a key. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Anand Krishnamoorthi (anakrish)
approved these changes
Oct 27, 2026
Anand Krishnamoorthi (anakrish)
left a comment
Anand Krishnamoorthi (anakrish)
left a comment
Collaborator
There was a problem hiding this comment.
LGTM
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues require changes to the Azure Policy field-path parsing update.
No open issues 🎉
What changed in this PR
Tightens Azure Policy field-path parsing, building on #866’s distinction between object keys and array indexes.
Changes:
- Treats only unquoted ASCII-digit bracket subscripts as indexes; signed subscripts remain keys.
- Saturates overflowing numeric indexes to
u64::MAXinstead of interpreting them as object keys. - Adds regression tests for parser edge cases, dotted numeric segments on arrays, and quoted numeric keys in existence conditions.
| File | Description |
|---|---|
tests/azure_policy/cases/fields.yaml |
Adds policy-level regression cases for overflow, dotted numeric segments, and existence-condition lookups. |
src/languages/azure_policy/compiler/utils.rs |
Tightens index classification, saturates overflow, and adds parser unit tests. |
Review effort: Balanced
Anand Krishnamoorthi (anakrish)
merged commit Oct 27, 2026
6d5c26c
into
microsoft:main
60 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #866 (quoted path keys). Tightens how unquoted bracket subscripts are parsed in Azure Policy field paths:
u64parsing accepted a leading+, soa[+1]silently became index 1; it is now the key"+1".config[18446744073709551616]used to fall back to the object key"18446744073709551616". It now saturates tou64::MAX: out of range on any array and never an object key, so the field is Undefined. The quoted form is still a key.properties.ipRules.1.valueno longer indexes the array), and quoted numeric keys work through the existenceCondition lookup path.Testing
Each fix has a counterexample case that fails before it, plus a non-match twin. Validated with Rust 1.95.0:
cargo fmt --check, clippy (--all-targets --all-featuresand--no-default-features),cargo test --all-features --lib azure_policy,cargo test --all-features --test mod azure_policy. Deep-reviewed (round 4, no findings).Dependencies: none (based on main).