StackGuardian / StackGuardian/tirith
fix(json): absent attributes are dropped, so "every element has X" is vacuously true
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 165
- Forks
- 42
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 11
Description
The json provider calls providers/common.get_path_value_from_input with the default
place_none_if_not_found=False: elements lacking the path are dropped rather than padded, so a
document that omits the attribute entirely — the classic violation, e.g. a VM with no
linuxConfiguration block — reports null instead of failing. Any wildcard-path policy can catch
an explicitly wrong value but never an absent one.
Fix. Expose the flag on get_value (default keeps today's behaviour). The same code path is
needed by "type-scoped member reads on the json provider" (R2).
Acceptance. A fixture with the attribute absent fails when the flag is set; a fixture with the
attribute present and compliant still passes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the JSON provider's get_value entry point and providers/common.get_path_value_from_input, tracing how the place_none_if_not_found flag is passed. Add the absent-attribute fixture and verify it fails when the flag is enabled, while a present and compliant attribute fixture still passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100