[PUP-9079] Rich data tags __ptype and __pvalue must not be allowed as attribute names Created: 2018/08/24  Updated: 2018/09/19  Resolved: 2018/09/17

Status: Closed
Project: Puppet
Component/s: None
Affects Version/s: None
Fix Version/s: PUP 6.0.0

Type: Bug Priority: Normal
Reporter: Thomas Hallgren Assignee: Unassigned
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Template: PUP Bug Template
Team: Platform Core
Method Found: Needs Assessment
Release Notes: Bug Fix
Release Notes Summary: Attempt to use the reserved attribute names {{__ptype}} and {{__pvalue}} in custom {{Object}} data types will now raise an error instead of producing bad result when serializing such objects.
QA Risk Assessment: Needs Assessment

 Description   

An attempt to use the rich data tag '__ptype' as the name of an attribute in an Object will cause a failure to serialize that object using the human readable Data format. An Object is represented as a Hash where '__ptype' is supposed to be a String representation of the type and an attribute using the same name causes the type to be overwritten. Use of '__pvalue' will cause a similar confusion when reading the `Object`.

The special rich data tags'__ptype' and '__pvalue' should not be permitted as names of attributes in an Object.



 Comments   
Comment by Tony Vu [ 2018/08/29 ]

Thomas Hallgren does this mean that the PCORE_TYPE_KEY in serialization needs to change?

Comment by Henrik Lindberg [ 2018/08/29 ]

Tony Vu No, it means that the Object type needs to raise an error if someone tries to create an Object that has __ptype or __pvalue as attribute names - ie. in something like:

type Car = Object[attributes => {__ptype => String}]

Comment by Josh Cooper [ 2018/08/30 ]

Couldn't rich data be serialized differently so as to not collide with values that happen to have to the keys? Obviously not likely, but it would eliminate this problem.

Comment by Henrik Lindberg [ 2018/08/31 ]

Yes, but would mean yet another alternative in the format - serializing the attributes as an alternative hash. That change would ripple through the various implementations though (go, typescript, java). I think it is best for now to just disallow __ptype and __pvalue as attribute names. If it ever becomes a problem it can be fixed then.

Comment by Scott Garman [ 2018/09/17 ]

Since we had a green run of CI puppet-agent 6.0.0 last night, I'm bulk-changing these issues from Ready for CI -> Resolved in preparation of the release.

Generated at Sun Apr 21 07:53:44 PDT 2019 using JIRA 7.7.1#77002-sha1:e75ca93d5574d9409c0630b81c894d9065296414.