mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-27 10:45:08 -06:00
Torin Sandall
57e7e89dff
Previously the rego package would construct rules for each of the PE query results when PartialResult() was invoked--however, it would not check if those rules would be recursive. If the user queried for `data` (or `data.<partialnamespace>`) then PE would return an (essentially) unmodified copy of the query and the rego package would happily construct a rule from it--since the rule is namespaced under data this leads to a recursion error. The problem is that the recursion error was caught by running the compiler--however, since the compiler is shared by the server and other components and since compile operations do not rollback changes on error, this approach left OPA in an inconsistent state. Some of the compiler data structures like the rule tree would include the PE result but any structures built by stages after the recursion check would be incomplete. This causes issues for the evaluator because it (rightfully) assumes that the compiler data structures are consistent. Since we can assume that PE results are valid and do not contain semantic errors and we do not intend to support the lazy PE API in the future, this commit fixes the issue/panic by modifying the rego package to check for recursion in the rules that it constructs. This is relatively simple since it merely has to check for prefixes in the refs contained in the PE query result. If recursion is caught, the rego package returns an error signalling that PE was ineffective. In this case, the server just falls back to normal eval. Fixes #2197 Signed-off-by: Torin Sandall <torinsandall@gmail.com>