Missing validation for condition-false `reference()` statements
- Dominant language
- Bicep
- Stars
- 3.6k
- Forks
- 830
- Avg merge
- 1d 21m
- Merged PRs (30d)
- 79
Description
The following Bicep file compiles just fine (with warnings, because of the property I made up), but fails ARM validation as the `reference(...)` function is evaluated regardless of the condition on the resource:
```bicep
var condition = false
resource test 'Microsoft.Storage/storageAccounts@2021-04-01' = if (condition) {
name: 'uniquename12982'
kind: 'StorageV2'
sku: {
name: 'Standard_LRS'
}
location: 'West US'
}
resource test2 'Microsoft.Storage/storageAccounts@2021-04-01' = if (condition) {
name: 'uniquename11298'
kind: 'StorageV2'
sku: {
name: 'Standard_LRS'
}
location: 'West US'
properties: {
someProp: test.properties.someProp
}
}
```
To fix it, change:
```bicep
someProp: test.properties.someProp
```
To:
```bicep
someProp: condition ? test.properties.someProp : null
```
This isn't made at all clear however. The template validation fails with:
```json
{
"code": "InvalidTemplate",
"message": "Deployment template validation failed: 'The template resource 'Microsoft.Storage/storageAccounts/uniquename11298' reference to 'Microsoft.Storage/storageAccounts/uniquename12982' requires an API version. Please see https://aka.ms/arm-template for usage details.'."
}
```
Contributor guide
Research direction
Start with the supplied Bicep reproduction and compare its compiler output with the ARM validation failure shown in the issue. Trace how condition-false resource references are analyzed, then add validation that clearly reports this invalid reference pattern before deployment and verify the example no longer compiles silently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100