Skip to content

Commit 4abe5a0

Browse files
authored
Update field_mask.const expression to avoid descriptor confusion (#450)
#429 added rules for field masks. In the rule `field_mask.const`, we're comparing two `google.protobuf.FieldMask` messages against each other with the CEL expression `this != getField(rules, 'const')`. This comparison is susceptible to type confusion in some Protobuf / CEL implementations. For example, protovalidate-go references the descriptor from `fieldmaskpb` when providing the value to CEL, but the user may provide a different instance of the field mask descriptor when validating a message. This results in a false negative when the two messages are compared by cel-go (see its behavior [here](https://github.com/google/cel-go/blob/v0.26.1/common/types/pb/equal.go#L30)). To mitigate the problem, this PR changes the CEL expression to compare field mask paths instead of field mask messages.
1 parent 7dc668e commit 4abe5a0

2 files changed

Lines changed: 6 additions & 6 deletions

File tree

proto/protovalidate/buf/validate/validate.proto

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4706,7 +4706,7 @@ message FieldMaskRules {
47064706
// ```
47074707
optional google.protobuf.FieldMask const = 1 [(predefined).cel = {
47084708
id: "field_mask.const"
4709-
expression: "this != getField(rules, 'const') ? 'value must equal paths %s'.format([getField(rules, 'const').paths]) : ''"
4709+
expression: "this.paths != getField(rules, 'const').paths ? 'value must equal paths %s'.format([getField(rules, 'const').paths]) : ''"
47104710
}];
47114711

47124712
// `in` requires the field value to only contain paths matching specified

tools/internal/gen/buf/validate/validate.pb.go

Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)