ga4gh / ga4gh/openapi-test-runner

validate_filters crashes on top-level filter paths (IndexError) and uses unsafe eval for DotMap access

Open
#79 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
HTML
Stars
5
Forks
6
PR merge metrics
No merged PRs in 30d

Description

## Summary

`compliance_suite/test_runner.py` assumes filter/storage paths always contain a dot and accesses `split('.', maxsplit=1)[1]`.
This crashes with `IndexError` when a top-level field path is used (for example `id`, `name`, `state`).

The same code path also uses `eval(...)` for DotMap traversal, which is unnecessary and risky.

## Affected Code

- `validate_filters(...)`
- `save_storage_vars(...)`

Historically:
```python
job_filter["path"].split('.', maxsplit=1)[1]
value.split('.', maxsplit=1)[1]
eval("dot_dict." + ...)
```

## Reproduction

1. Add a filter with a top-level path in a test YAML, for example:
```yaml
filter:
- path: "id"
type: "string"
```
2. Run compliance tests.
3. Observe crash in `validate_filters`.

## Actual Result

Test run fails with:
- `IndexError: list index out of range` (from `split(...)[1]`)

## Expected Result

- Top-level and nested paths should both work.
- Path traversal should not require `eval(...)`.
- Filter and storage-var path handling should be robust and deterministic.

## Root Cause

Path parsing assumes all paths contain a leading root segment and at least one dot.
Top-level paths violate that assumption.

## Proposed Fix

1. Normalize path first:
- use `path.split('.', maxsplit=1)[-1]` (safe for both dotted and non-dotted paths)
2. Replace `eval(...)` with explicit DotMap traversal helper:
- iterate path tokens and apply `getattr(...)`

## Acceptance Criteria

- Top-level filter path does not crash.
- Nested filter path still works.
- `save_storage_vars` behaves correctly for top-level and nested paths.
- No `eval(...)` remains in these path traversal code paths.
- Add/adjust tests to cover both path forms.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in compliance_suite/test_runner.py at validate_filters(...) and save_storage_vars(...), then run the compliance tests with both top-level and nested paths. Check the existing path handling and DotMap access, and add or adjust tests covering both forms. Done means neither path form crashes, nested behavior remains intact, and these traversal paths no longer use eval(...).

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.