ga4gh / ga4gh/openapi-test-runner
validate_filters crashes on top-level filter paths (IndexError) and uses unsafe eval for DotMap access
- Dominant language
- HTML
- Stars
- 5
- Forks
- 6
- PR merge metrics
- No merged PRs in 30d
Description
## Summary
`compliance_suite/test_runner.py` assumes filter/storage paths always contain a dot and accesses `split('.', maxsplit=1)[1]`.
This crashes with `IndexError` when a top-level field path is used (for example `id`, `name`, `state`).
The same code path also uses `eval(...)` for DotMap traversal, which is unnecessary and risky.
## Affected Code
- `validate_filters(...)`
- `save_storage_vars(...)`
Historically:
```python
job_filter["path"].split('.', maxsplit=1)[1]
value.split('.', maxsplit=1)[1]
eval("dot_dict." + ...)
```
## Reproduction
1. Add a filter with a top-level path in a test YAML, for example:
```yaml
filter:
- path: "id"
type: "string"
```
2. Run compliance tests.
3. Observe crash in `validate_filters`.
## Actual Result
Test run fails with:
- `IndexError: list index out of range` (from `split(...)[1]`)
## Expected Result
- Top-level and nested paths should both work.
- Path traversal should not require `eval(...)`.
- Filter and storage-var path handling should be robust and deterministic.
## Root Cause
Path parsing assumes all paths contain a leading root segment and at least one dot.
Top-level paths violate that assumption.
## Proposed Fix
1. Normalize path first:
- use `path.split('.', maxsplit=1)[-1]` (safe for both dotted and non-dotted paths)
2. Replace `eval(...)` with explicit DotMap traversal helper:
- iterate path tokens and apply `getattr(...)`
## Acceptance Criteria
- Top-level filter path does not crash.
- Nested filter path still works.
- `save_storage_vars` behaves correctly for top-level and nested paths.
- No `eval(...)` remains in these path traversal code paths.
- Add/adjust tests to cover both path forms.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in compliance_suite/test_runner.py at validate_filters(...) and save_storage_vars(...), then run the compliance tests with both top-level and nested paths. Check the existing path handling and DotMap access, and add or adjust tests covering both forms. Done means neither path form crashes, nested behavior remains intact, and these traversal paths no longer use eval(...).
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- testing-qa
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100