loader: fail-closed allowlist screening on top of the unsupported-attributes check - #2
Merged
glours merged 1 commit intoSep 8, 2026
Conversation
…ributes check Deny patterns alone reproduce the problem they solve: every attribute the specification gains later falls through silently until someone adds a check. This layers the complementary allowlist onto UnsupportedAttributesCheck, sharing its walk and report: - Supported (or the composable WithSupportedAttributes option) declares the attribute paths the runtime implements; anything matching none of them is reported alongside the deny-pattern findings. Extension keys (x-*) and everything under them are exempt from this rule set (deny patterns still apply below them). - schema.AttributePaths derives the complete attribute-path inventory from the embedded JSON schema (pattern-keyed mappings as '*', sequence items as '[]', $ref cycles terminated, '^x-' pattern properties excluded, since a wildcard there would blanket-accept every undeclared sibling). A runtime builds its declaration by removing what it does not implement from the full specification. - tree.Matcher gives Path pattern sets a first-class matching API: exact Matches — declaring a path accepts that node only, so removing one leaf reliably surfaces it — plus MayContain for walkers that must know when a declared attribute lives deeper. Matching stays exact by design: subtree removal reports once at its root, leaf removal reports each leaf, and declared siblings keep the descent open. Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Layered on top of compose-spec#927's API (compose-spec#927), sharing its walk and batch report — the fail-closed half from compose-spec#926:
Supported(or the composableWithSupportedAttributesoption) declares the attribute paths the runtime implements; anything matching none of them is reported alongside the deny-pattern findings. Deny patterns keep covering the value-dependent cases (ports[].mode: host); the allowlist makes the screening exhaustive: every attribute the specification gains later stays reported until the runtime deliberately wires it in. Extension keys (x-*) and their subtrees are exempt from this rule set.schema.AttributePathsderives the complete attribute-path inventory from the embedded JSON schema, so a runtime declares by subtraction:slices.DeleteFunc(slices.Clone(schema.AttributePaths()), isSwarmOnly).tree.Matchermakes Path pattern-set matching a first-class API (exactMatches+MayContainfor walkers). Matching is exact by design: subtree removal reports once at its root, leaf removal reports each leaf, declared siblings keep the descent open.Combined-usage test included: one load, one report, deny predicate (
mode: host) and allowlist findings together.🤖 Generated with Claude Code