enbility / spine-go

94%

push

github

🐛 fix: add cmdFunction parameter to FilterType.Data() for partial filter handling (#67)

This critical fix addresses type confusion vulnerabilities and improves
SPINE protocol compliance by properly handling partial filters without
selectors.

## Changes:
- **BREAKING**: FilterType.Data() now requires cmdFunction parameter
- Add cmdFunction parameter to all UpdateList implementations (30+
files)
- Fix critical bug where UpdateList returned slices instead of complete
structs
- Add validation helpers for cmd.Function consistency checking
- Add comprehensive test coverage for function mismatches and edge cases

## Security Improvements:
- Prevent type confusion attacks where cmd.Function doesn't match filter
functions
- Proper fallback to cmdFunction for partial filters without selectors
- Validation methods to detect and report function inconsistencies

## Bug Fixes:
- Fix panic in TestLoadControlLimitListDataType_Update (line 126)
- Correct partial filter logic that incorrectly used selector path when
no selectors present
- Return complete structs from UpdateList, not just data slices
- Fix incorrect field names in multiple *_additions.go files

## Spec Compliance:
- Properly implements SPINE Table 6/7 requirements for partial updates
- Handles "copy to all" pattern when identifiers are missing
- Supports valid partial filters without selectors (meaning "all
fields")

## Testing:
- Add cmd_function_filter_mismatch_test.go for security validation
- Add cmd_validation_additions_test.go for consistency checks
- Add device_local_validation_test.go for local device validation
- Update all existing tests to use new cmdFunction parameter

BREAKING CHANGE: FilterType.Data() signature changed to require
cmdFunction parameter. All code using FilterType.Data() must be updated
to pass the cmdFunction.

310 of 322 new or added lines in 32 files covered. (96.27%)

5609 of 5967 relevant lines covered (94.0%)

28518.13 hits per line