Reimplement dangerous request parameter check with visitor #380
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The
usesAuthenticatedRequestParameters
andusesUnauthenticatedRequestParameters
properties are currently computed whenever we're constructing or composing a clause in thesync-rules
compiler.While that's a fairly simple implementation, it doesn't scale well if we're trying to infer more information about used clauses in the future. In particular, I'm looking at a lint that would require knowing whether a query uses stream parameters. Adding that information (or more features in the future) to all clauses would complicate the implementation.
So, this refactors the check to use the visitor pattern:
OR
combinator for parameter match clauses also has a special key so that we can apply the special behavior (it only counts if both sides are using authenticated parameters).