Closed DCRUNNN closed 1 year ago
Thanks @DCRUNNN! That looks like a bug indeed. A PR including tests for this case sounds like a great next step! 😃
@anderseknert thanks for the reply! PTAL:https://github.com/open-policy-agent/opa/pull/5969
Nice! Thanks @DCRUNNN 👍
Short description
The object.subset method seems to have a bug when determining whether two arrays are in a parent-child relationship. Here is an example:
Steps To Reproduce
rego file:
expect:false got:true
you can run the example above on the playground
Additional context
This seems to be caused by line 201 in the file https://github.com/open-policy-agent/opa/blob/main/topdown/subset.go.
I have written a custom function locally to determine whether two arrays are in a parent-child relationship, and modifying it as superElem := super.Elem(superCursor + subCursor) can solve the issue.
This is the information regarding this problem. Please review it, and I will submit a PR later.