StackGuardian / StackGuardian/tirith

fix(json): absent attributes are dropped, so "every element has X" is vacuously true

Open Beginner friendly
#294 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
165
Forks
42
Avg merge
1d 3h
Merged PRs (30d)
11

Description

The json provider calls providers/common.get_path_value_from_input with the default
place_none_if_not_found=False: elements lacking the path are dropped rather than padded, so a
document that omits the attribute entirely — the classic violation, e.g. a VM with no
linuxConfiguration block — reports null instead of failing. Any wildcard-path policy can catch
an explicitly wrong value but never an absent one.

Fix. Expose the flag on get_value (default keeps today's behaviour). The same code path is
needed by "type-scoped member reads on the json provider" (R2).

Acceptance. A fixture with the attribute absent fails when the flag is set; a fixture with the
attribute present and compliant still passes.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the JSON provider's get_value entry point and providers/common.get_path_value_from_input, tracing how the place_none_if_not_found flag is passed. Add the absent-attribute fixture and verify it fails when the flag is enabled, while a present and compliant attribute fixture still passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.