Fix Sequence[Union[...]] validation only requiring one element to match - #2108
Open
Nimra3261 wants to merge 1 commit into
Open
Fix Sequence[Union[...]] validation only requiring one element to match#2108Nimra3261 wants to merge 1 commit into
Nimra3261 wants to merge 1 commit into
Conversation
_is_valid's Sequence[Union[X, Y]] branch flattened the per-element check
into a single any() across (value, union_arg) pairs:
return any(isinstance(val, union_arg) for val in value for union_arg in union_args)
This means the check passes as soon as ONE element matches ONE type in
the union, regardless of whether other elements in the sequence match
anything at all. E.g. _is_valid(Sequence[Union[str, int]], ["a", 3.14])
returns True even though 3.14 is neither a str nor an int.
This is reachable through real user-facing validation: collection.tenants
add/remove/update/upsert all validate their `tenants` argument against
Sequence[Union[str, Tenant, ...]] (weaviate/collections/tenants/executor.py).
A list mixing a valid tenant name/object with something invalid (e.g. an
accidental int, or a stray dict) currently passes validation silently and
gets sent to the request-building code instead of failing fast with a
clear WeaviateInvalidInputError - the exact thing this argument
validation exists to prevent.
Fixed to require every element to match at least one union member:
all(any(...) for val in value), matching the existing (correct) logic
for the non-Union Sequence[X] branch two lines below it.
Added regression tests in test/collection/test_validator.py - verified
they fail against the pre-fix code (3 failures) and pass with the fix.
![orca-security-eu[bot]](https://avatars.githubusercontent.com/in/276244?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Infrastructure as Code |  0  0  0  0 |
View in Orca |
| Passed |
SAST | 0 0 0 0 |
View in Orca |
| Passed |
Secrets | 0 0 0 0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
|
To avoid any confusion in the future about your contribution to Weaviate, we work with a Contributor License Agreement. If you agree, you can simply add a comment to this PR that you agree with the CLA so that we can merge. |
Author
|
I agree to the Contributor License Agreement. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
_is_valid'sSequence[Union[X, Y]]branch flattens the per-element check into a singleany()across (value, union_arg) pairs:This means validation passes as soon as one element matches one type in the union, regardless of whether the other elements match anything at all:
Where this is user-facing
weaviate/collections/tenants/executor.pyvalidatestenantsagainstSequence[Union[str, Tenant, ...]]in add/remove/update/upsert. A list mixing a valid tenant name/object with something invalid (an accidental int, a stray dict, etc.) currently passes this validation silently and gets forwarded into request-building instead of failing fast with a clearWeaviateInvalidInputError- the exact thing this validation exists to catch.Fix
Require every element to match at least one union member:
all(any(...) for val in value), matching the existing (correct) logic already used two lines below for the non-UnionSequence[X]branch.Testing
Added regression tests in
test/collection/test_validator.py. Verified they fail against the pre-fix code (3 failures, confirming they actually exercise the bug) and pass with the fix. Fulltest_validator.pyfile: 19/19 passing.