fix(query): fix false positive in schema_required_property_undefined#8082
Open
haroldb1 wants to merge 1 commit into
Open
fix(query): fix false positive in schema_required_property_undefined#8082haroldb1 wants to merge 1 commit into
haroldb1 wants to merge 1 commit into
Conversation
…when sole required property The predicate `all([property | property != requiredProperty; _ := schema.properties[property]])` was logically inverted, producing two failure modes: - False positive: when `requiredProperty` is the only entry in `properties`, the comprehension yields `[]` and `all([])` is vacuously true — the rule fires even though the property is correctly defined. - False negative: when `requiredProperty` is genuinely absent but sibling properties exist, the comprehension yields a non-empty list of strings and `all(["sibling"])` is false — the rule does not fire, missing a real violation. Replace with a direct absence check: `not schema.properties[requiredProperty]` This evaluates to true if and only if the required property has no entry in `properties`, regardless of how many siblings exist. Fixes Checkmarx#8081 Tests: - negative7.yaml: sole required property present — must not fire (was false positive) - positive7.yaml: required property absent with sibling present — must fire (was false negative) - All six existing positive fixtures continue to fire (regression-checked locally)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…when sole required property
The predicate
all([property | property != requiredProperty; _ := schema.properties[property]])was logically inverted, producing two failure modes:False positive: when
requiredPropertyis the only entry inproperties, the comprehension yields[]andall([])is vacuously true — the rule fires even though the property is correctly defined.False negative: when
requiredPropertyis genuinely absent but sibling properties exist, the comprehension yields a non-empty list of strings andall(["sibling"])is false — the rule does not fire, missing a real violation.Replace with a direct absence check:
not schema.properties[requiredProperty]This evaluates to true if and only if the required property has no entry inproperties, regardless of how many siblings exist.Fixes #8081
Tests:
Closes #
Reason for Proposed Changes
Proposed Changes
I submit this contribution under the Apache-2.0 license.