fix(error-tracking): allow sortableSemver in suppression-rule bytecode#58700
Draft
posthog[bot] wants to merge 1 commit into
Draft
fix(error-tracking): allow sortableSemver in suppression-rule bytecode#58700posthog[bot] wants to merge 1 commit into
posthog[bot] wants to merge 1 commit into
Conversation
The suppression-rule save endpoint compiles property filters into HogVM bytecode and then validates every CALL_GLOBAL against an allowlist of functions the rust HogVM is known to implement. SEMVER_* property operators compile down to sortableSemver(...) calls, which the rust HogVM has shipped as part of its hog STL but which were missing from the Python allowlist — so any rule with a semver filter (e.g. app_version >= 1.2.3) was deterministically rejected with a 400. Add sortableSemver to the allowlist, plus extractRegex and multiSearchAnyCaseInsensitive — both of which also exist in the rust HogVM STL but were absent from the Python allowlist, pre-empting the same class of bug for future property compilations. Also point the bin/dump_hogvmrs_stl helper at the file's current location in products/error_tracking/backend/ (previously stale path under posthog/models/error_tracking/). Generated-By: PostHog Code Task-Id: 16b55b6d-30b9-42fc-aadc-853eb2cae944
Contributor
|
🎭 Playwright didn't run on this PR — your changes touch code that could affect E2E behavior, but Playwright is opt-in via label now to keep CI cost down. Add the Most PRs don't need this. Real regressions still get caught on master and fix-forward. |
Contributor
|
Size Change: +6.38 kB (+0.01%) Total Size: 117 MB 📦 View Changed
ℹ️ View Unchanged
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Users trying to save an error-tracking suppression rule that filters on a semver property (e.g.
app_version >= 1.2.3) hit a hard 400 with no workaround beyond switching to a non-semver operator. The save endpoint compiles property filters to HogVM bytecode and then runs everyCALL_GLOBALop through an allowlist (products/error_tracking/backend/hogvm_stl.py) of functions the rust HogVM is known to implement.SEMVER_*operators compile down tosortableSemver(...)calls, which the rust HogVM has shipped as part of its hog STL — butsortableSemverwas never added to the Python-side allowlist, so the validator deterministically rejects the rule withValidationError: Unknown global function: sortableSemver.This produced a brand-new error-tracking issue (
Error: Unknown global function: sortableSemver, thrown fromapi.errorTracking.createRuleinsidesuppressionRuleModalLogic.ts:108).Changes
sortableSemvertoRUST_HOGVM_STLso all nineSEMVER_*property operators (eq,neq,gt,gte,lt,lte,tilde,caret,wildcard) pass validation.rust/common/hogvm/src/stl.rs), also addextractRegexandmultiSearchAnyCaseInsensitive— both shipped natively in the rust VM but missing from the Python allowlist, pre-empting the same class of bug for any future property-compilation path that emits them.bin/dump_hogvmrs_stlat the file's current location underproducts/error_tracking/backend/(the script was still writing to the long-goneposthog/models/error_tracking/hogvm_stl.py).SEMVER_*operator against a representativeapp_versionfilter via thePOST /api/environments/{team}/error_tracking/suppression_rules/endpoint.How did you test this code?
I'm an agent. Manual API testing was not done. Automated checks run locally:
semver_gtefilter viaproperty_to_expr+create_bytecodeand confirmed it now passesvalidate_bytecode. Repeated for all nineSEMVER_*operators (eq, neq, gt, gte, lt, lte, tilde, caret, wildcard).ruff checkandruff format --checkclean on changed files.test_create_with_semver_filter) is parameterized over all nine operators; pytest collected each case correctly. Full execution requires a Postgres-backed test environment, which was not available locally.Publish to changelog?
no
🤖 Agent context
Authored by PostHog Code from a signal report. The signal pinpointed both the cause (allowlist missing
sortableSemver) and the fix; the agent verified the call name emitted byproperty_to_exprfor everySEMVER_*operator, auditedrust/common/hogvm/src/stl.rsfor other gaps (foundextractRegex,multiSearchAnyCaseInsensitive), and noticed the stale path inbin/dump_hogvmrs_stlwhile there. The audit deliberately limits the additions to functions actually exported by the rust HogVM today — no other gaps were found.Created with PostHog Code