Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve marks support for length and lookup #28644

Merged
merged 2 commits into from
May 7, 2021

Conversation

alisdair
Copy link
Member

@alisdair alisdair commented May 7, 2021

We improved marks support for these two functions in zclconf/go-cty#98, not realizing that Terraform has its own separate and incompatible implementations. These commits bring across essentially the same changes, re-applied to these local versions.

functions: Improve marks support for length

Similar to cty's implementation, we only need to preserve marks from the value itself, not any nested values it may contain. This means that taking the length of an umarked list with marked elements results in an unmarked number.

functions: Improve marks support for lookup

Several changes to lookup to improve how we handle marked values:

  • If the entire collection is marked, preserve the marks on any result (whether successful or fallback)
  • If a returned value from the collection is marked, preserve the marks from only that value, combined with any overall collection marks
  • Retain marks on the fallback value when it is returned, combined with any overall collection marks
  • Include marks on the key in the result, as otherwise the result it ends up selecting could imply what the sensitive value was
  • Retain collection marks when returning an unknown value for a not wholly-known collection

Fixes #28638

Similar to cty's implementation, we only need to preserve marks from the
value itself, not any nested values it may contain. This means that
taking the length of an umarked list with marked elements results in an
unmarked number.
Several changes to lookup to improve how we handle marked values:

- If the entire collection is marked, preserve the marks on any result
  (whether successful or fallback)
- If a returned value from the collection is marked, preserve the marks
  from only that value, combined with any overall collection marks
- Retain marks on the fallback value when it is returned, combined with
  any overall collection marks
- Include marks on the key in the result, as otherwise the result it
  ends up selecting could imply what the sensitive value was
- Retain collection marks when returning an unknown value for a not
  wholly-known collection

See also zclconf/go-cty#98
@alisdair alisdair added functions 0.15-backport If you add this label to a PR before merging, backport-assistant will open a new PR once merged labels May 7, 2021
@alisdair alisdair requested a review from a team May 7, 2021 17:01
@alisdair alisdair self-assigned this May 7, 2021
@alisdair alisdair merged commit fb53259 into main May 7, 2021
@alisdair alisdair deleted the alisdair/length-lookup-marks-fixes branch May 7, 2021 17:54
@github-actions
Copy link

github-actions bot commented Jun 7, 2021

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jun 7, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
0.15-backport If you add this label to a PR before merging, backport-assistant will open a new PR once merged functions
Projects
None yet
Development

Successfully merging this pull request may close these issues.

for_each rejects secrets as map values
2 participants