fix: reject leading-zero semver values in local evaluation#601
Open
dmarticus wants to merge 2 commits into
Open
fix: reject leading-zero semver values in local evaluation#601dmarticus wants to merge 2 commits into
dmarticus wants to merge 2 commits into
Conversation
Per semver 2.0.0 §2, numeric identifiers must not include leading zeros. Values like "1.07.3" are not valid semver and should not match targeting conditions. Both override values and flag values are validated; invalid inputs raise InconclusiveMatchError so the condition simply doesn't match. Adds explicit rejection in parse_semver and the wildcard parser, and updates the edge-case test that previously asserted "01.02.03" matched "1.2.3".
Contributor
Prompt To Fix All With AIFix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
posthog/test/test_feature_flags.py:4572-4622
**Prefer `@pytest.mark.parametrize` over manual `for` loops**
The custom instruction for this repo says "We always prefer parameterised tests." The inner `for bad_value in [...]` loop is a manual workaround: when the first iteration fails the loop aborts, masking all subsequent failures. The entire method also bundles several independent concerns (invalid override values, invalid flag values, range operators) into one test, which makes failures hard to pinpoint. Each group of logically-related cases should be its own `@pytest.mark.parametrize`-driven test, matching the pattern of the existing semver tests in this file.
Reviews (1): Last reviewed commit: "Reject semver values with leading zeros ..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
dmarticus
changed the title
6 tasks
Split the single bundled test into three @parameterized.expand-driven tests (override-value rejection, literal-zero acceptance, flag-value rejection per operator) so failures point at the specific case that broke. Matches the project's preference for parameterised tests.
Contributor
posthog-python Compliance ReportDate: 2026-05-20 22:31:37 UTC
|
| Test | Status | Duration |
|---|---|---|
| Format Validation.Event Has Required Fields | ✅ | 516ms |
| Format Validation.Event Has Uuid | ✅ | 1507ms |
| Format Validation.Event Has Lib Properties | ✅ | 1507ms |
| Format Validation.Distinct Id Is String | ✅ | 1506ms |
| Format Validation.Token Is Present | ✅ | 1507ms |
| Format Validation.Custom Properties Preserved | ✅ | 1507ms |
| Format Validation.Event Has Timestamp | ✅ | 1507ms |
| Retry Behavior.Retries On 503 | ✅ | 9518ms |
| Retry Behavior.Does Not Retry On 400 | ✅ | 3505ms |
| Retry Behavior.Does Not Retry On 401 | ✅ | 3508ms |
| Retry Behavior.Respects Retry After Header | ✅ | 9514ms |
| Retry Behavior.Implements Backoff | ✅ | 23518ms |
| Retry Behavior.Retries On 500 | ✅ | 7512ms |
| Retry Behavior.Retries On 502 | ✅ | 7513ms |
| Retry Behavior.Retries On 504 | ✅ | 7512ms |
| Retry Behavior.Max Retries Respected | ✅ | 23526ms |
| Deduplication.Generates Unique Uuids | ✅ | 1501ms |
| Deduplication.Preserves Uuid On Retry | ✅ | 7514ms |
| Deduplication.Preserves Uuid And Timestamp On Retry | ✅ | 14514ms |
| Deduplication.Preserves Uuid And Timestamp On Batch Retry | ✅ | 7514ms |
| Deduplication.No Duplicate Events In Batch | ✅ | 1504ms |
| Deduplication.Different Events Have Different Uuids | ✅ | 1506ms |
| Compression.Sends Gzip When Enabled | ✅ | 1507ms |
| Batch Format.Uses Proper Batch Structure | ✅ | 1507ms |
| Batch Format.Flush With No Events Sends Nothing | ✅ | 1004ms |
| Batch Format.Multiple Events Batched Together | ✅ | 1506ms |
| Error Handling.Does Not Retry On 403 | ✅ | 3509ms |
| Error Handling.Does Not Retry On 413 | ✅ | 3506ms |
| Error Handling.Retries On 408 | ✅ | 7510ms |
Feature_Flags Tests
View Details
| Test | Status | Duration |
|---|---|---|
| Request Payload.Request With Person Properties Device Id | ❌ | 509ms |
| Request Payload.Flags Request Uses V2 Query Param | ❌ | 300533ms |
| Request Payload.Flags Request Hits Flags Path Not Decide | ❌ | 300992ms |
| Request Payload.Flags Request Omits Authorization Header | ❌ | 300996ms |
| Request Payload.Token In Flags Body Matches Init | ❌ | 300989ms |
| Request Payload.Groups Round Trip | ❌ | 300991ms |
| Request Payload.Groups Default To Empty Object | ❌ | 301032ms |
| Request Payload.Person Properties Distinct Id Auto Populated When Caller Omits It | ❌ | 300994ms |
| Request Payload.Disable Geoip False Propagates As Geoip Disable False | ❌ | 300958ms |
| Request Payload.Disable Geoip Omitted Defaults To False | ❌ | 301007ms |
| Request Payload.Flag Keys To Evaluate Contains Only Requested Key | ❌ | 301056ms |
| Request Lifecycle.No Flags Request On Init Alone | ❌ | 300969ms |
| Request Lifecycle.No Flags Request On Normal Capture | ❌ | 300945ms |
| Request Lifecycle.Two Flag Calls Produce Two Remote Requests | ❌ | 301084ms |
| Request Lifecycle.Mock Response Value Is Returned To Caller | ❌ | 300912ms |
| Side Effect Events.Get Feature Flag Captures Feature Flag Called Event | ❌ | 301088ms |
Failures
request_payload.request_with_person_properties_device_id
Field 'token' not found in /flags request body at path 'token'. Available keys: ['distinct_id', 'groups', 'person_properties', 'group_properties', 'geoip_disable', 'device_id', 'flag_keys_to_evaluate', 'sentAt', 'api_key']
request_payload.flags_request_uses_v2_query_param
No error message
request_payload.flags_request_hits_flags_path_not_decide
No error message
request_payload.flags_request_omits_authorization_header
No error message
request_payload.token_in_flags_body_matches_init
No error message
request_payload.groups_round_trip
No error message
request_payload.groups_default_to_empty_object
No error message
request_payload.person_properties_distinct_id_auto_populated_when_caller_omits_it
No error message
request_payload.disable_geoip_false_propagates_as_geoip_disable_false
No error message
request_payload.disable_geoip_omitted_defaults_to_false
No error message
request_payload.flag_keys_to_evaluate_contains_only_requested_key
No error message
request_lifecycle.no_flags_request_on_init_alone
No error message
request_lifecycle.no_flags_request_on_normal_capture
No error message
request_lifecycle.two_flag_calls_produce_two_remote_requests
No error message
request_lifecycle.mock_response_value_is_returned_to_caller
No error message
side_effect_events.get_feature_flag_captures_feature_flag_called_event
No error message
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Per semver 2.0.0 §2, numeric identifiers MUST NOT include leading zeros. Values like
1.07.3or01.2.3are not valid semver — the local feature flag evaluator currently parses them silently (viaint("07") → 7), which means a person property of1.07.3would incorrectly match asemver_eqcondition against1.7.3.This PR makes the parser reject leading zeros in numeric identifiers. Both override values and flag values are validated; invalid inputs raise
InconclusiveMatchErrorso the condition simply does not match.Changes
parse_semvernow uses a_semver_numeric_identifierhelper that rejects strings with leading zeros (except literal"0")._wildcard_boundsuses the same helper, so01.*and1.07.*are rejected.01.02.03matched1.2.3— it now correctly rejects.test_match_properties_semver_rejects_leading_zeroscovering override values, flag values, and all range operators.Test plan
pytest posthog/test/test_feature_flags.py— 128 passedruff formatcleanfeature_flags.py