Skip to content

versionCompare in jexl_to_sql accepts any mapped column, including string columns #17248

Description

@jaredlockhart

_version_compare_binary_to_sql_with used to only accept version. It now accepts any attribute present in the app's column map:

https://github.com/mozilla/experimenter/blob/main/experimenter/experimenter/experiments/jexl*to*sql.py#L623-L631

It then emits <column> >= <major>, comparing the column to an integer. That is correct for androidSdkVersion on Fenix, which is an INTEGER column, but there is nothing stopping a string column going through the same path.

appVersion is the one to worry about. It is a STRING column in both mobile tables and it is in the shared mobile column map, so app_version|versionCompare('140.!') >= 0 would generate appVersion >= 140 and fail the dry run with a signature error. No targeting config uses that today, so CI is green, but the next mobile version-targeting config would turn the job red instead of just warning.

Worth noting androidSdkVersion is INTEGER on Fenix and STRING on iOS. That is only safe right now because the iOS map does not include it.

Acceptance criteria:

  • versionCompare only accepts columns known to be numeric, via an explicit allowlist rather than map membership
  • anything else adds a warning as before
  • test covers a string column being rejected

┆Issue is synchronized with this Jira Task

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    Priority

    None yet

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions