diranged / oz / 38484866442
36%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 83
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 35.907%. Remained the same
38484866442

push

github

web-flow 
chore(deps): update module github.com/google/cel-go to v0.29.0 [security] (#462)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [github.com/google/cel-go](https://redirect.github.com/google/cel-go)
| `v0.26.0` → `v0.29.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgoogle%2fcel-go/v0.29.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgoogle%2fcel-go/v0.26.0/v0.29.0?slim=true)
|

---

### cel-go: JSON Private Fields Exposed via NativeTypes and
ParseStructTag

[GHSA-gcjh-h69q-9w9g](https://redirect.github.com/advisories/GHSA-gcjh-h69q-9w9g)

<details>
<summary>More information</summary>

#### Details
The function `ext.NativeTypes(ParseStructTag("json"))` does not honour
the `encoding/json` skip directive `json:"-"`. Fields tagged `json:"-"`
are registered in the CEL type system under the literal name `"-"` and
are readable from any user-submitted CEL expression via `dyn(obj)["-"]`.

Additionally, `newNativeTypes` silently registers every nested struct
reachable from the type passed to `NativeTypes`, including types from
third-party dependencies the developer never examined.

##### Root cause

In `fieldNameByTag`, the helper used by `ParseStructTag("json")` to
translate Go struct tags into CEL field names.

See at `ext/native.go:146`:

```go
func fieldNameByTag(structTagToParse string) func(field reflect.StructField) string {
    return func(field reflect.StructField) string {
        tag, found := field.Tag.Lookup(structTagToParse)
        if found {
            splits := strings.Split(tag, ",")
            if len(splits) > 0 {
                // We make the assumption that the leftmost entry in the tag is the name.
                // This seems to be true for most tags that have the concept of a name/key, such as:
              ... (continued)

1037 of 2888 relevant lines covered (35.91%)

1.59 hits per line

Jobs
ID Job ID Ran Files Coverage
1 38484866442.1 83
35.91
GitHub Action Run
Source Files on build 38484866442