fix: propagate null through dict and map bracket access (#7079)

* fix: propagate null through dict and map bracket access

Change dict [] and map [] operators to propagate null when the parent
element is nil, instead of returning a runtime error. This aligns the
behavior of [] with the existing []? (conditional access) operator.

Before this change, expressions like:
  dict["domain"]["key"]
would fail with "cannot access field key, parent element is null"
when the parent key did not exist in the dict/map.

After this change, the expression evaluates to null, which then
correctly evaluates to false in boolean comparisons. This is the
expected behavior for dict/map chains where intermediate keys may
not be present.

The []? operator already had this behavior; now [] matches it.
The isConditional parameter is removed since both paths are identical.

* refactor: collapse duplicate index handlers

Author: syrull

llx/builtin.go

@@ -539,7 +539,7 @@ func init() {
 			string("*" + types.Time):                 {f: dictTimesTimeV2, Label: "*"},
 			// fields
 			"[]":                              {f: dictGetIndex},
-			"[]?":                             {f: dictGetConditionalIndex},
+			"[]?":                             {f: dictGetIndex},
 			"first":                           {f: dictGetFirstIndexV2},
 			"last":                            {f: dictGetLastIndexV2},
 			"{}":                              {f: dictBlockCallV2},
@@ -724,7 +724,7 @@ func init() {
 		},
 		types.MapLike: {
 			"[]":                       {f: mapGetIndex},
-			"[]?":                      {f: mapGetConditionalIndex},
+			"[]?":                      {f: mapGetIndex},
 			"length":                   {f: mapLengthV2},
 			"where":                    {f: mapWhereV2},
 			"$whereNot":                {f: mapWhereNotV2},

llx/builtin_map.go

@@ -18,14 +18,6 @@ import (
 var mapFunctions map[string]chunkHandlerV2 //nolint:unused
 
 func mapGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
-	return _mapGetIndex(e, bind, chunk, ref, false)
-}
-
-func mapGetConditionalIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
-	return _mapGetIndex(e, bind, chunk, ref, true)
-}
-
-func _mapGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64, isConditional bool) (*RawData, uint64, error) {
 	args := chunk.Function.Args
 	// TODO: all this needs to go into the compile phase
 	if len(args) < 1 {
@@ -36,13 +28,10 @@ func _mapGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64, isC
 	}
 	// ^^ TODO
 
+	childType := bind.Type.Child()
 	if bind.Value == nil {
-		if isConditional {
-			return &RawData{Type: bind.Type.Child()}, 0, nil
-		} else {
-			field := args[0].LabelV2(e.ctx.code)
-			return nil, 0, errors.New("cannot access map field " + field + ", map is null")
-		}
+		// Propagate null through map access chains instead of erroring.
+		return &RawData{Type: childType}, 0, nil
 	}
 
 	var key string
@@ -65,15 +54,6 @@ func _mapGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64, isC
 		return nil, 0, errors.New("Called [] with wrong type " + t.Label())
 	}
 
-	childType := bind.Type.Child()
-
-	if bind.Value == nil {
-		return &RawData{
-			Type:  childType,
-			Value: nil,
-		}, 0, nil
-	}
-
 	m, ok := bind.Value.(map[string]any)
 	if !ok {
 		return nil, 0, errors.New("failed to typecast " + bind.Type.Label() + " into map")
@@ -372,14 +352,6 @@ func mapValuesV2(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*Ra
 }
 
 func dictGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
-	return _dictGetIndex(e, bind, chunk, ref, false)
-}
-
-func dictGetConditionalIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
-	return _dictGetIndex(e, bind, chunk, ref, true)
-}
-
-func _dictGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64, isConditional bool) (*RawData, uint64, error) {
 	args := chunk.Function.Args
 	// TODO: all this needs to go into the compile phase
 	if len(args) < 1 {
@@ -390,12 +362,10 @@ func _dictGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64, is
 	}
 
 	if bind.Value == nil {
-		if isConditional {
-			return &RawData{Type: bind.Type}, 0, nil
-		} else {
-			field := args[0].LabelV2(e.ctx.code)
-			return nil, 0, errors.New("cannot access field " + field + ", parent element is null")
-		}
+		// Propagate null through dict access chains instead of erroring.
+		// This enables expressions like dict['a']['b'] to evaluate to null
+		// when dict['a'] is nil, rather than failing with a runtime error.
+		return &RawData{Type: bind.Type}, 0, nil
 	}
 
 	switch x := bind.Value.(type) {

llx/builtin_map_test.go

@@ -0,0 +1,64 @@
+// Copyright (c) Mondoo, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package llx
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.mondoo.com/mql/v13/types"
+)
+
+func newTestBlockExecutor() *blockExecutor {
+	return &blockExecutor{
+		ctx: &MQLExecutorV2{code: &CodeV2{}},
+	}
+}
+
+func newStringKeyChunk() *Chunk {
+	return &Chunk{
+		Function: &Function{
+			Args: []*Primitive{{Value: []byte("key"), Type: string(types.String)}},
+		},
+	}
+}
+
+func runIndexHandler(t *testing.T, bind *RawData, operator string) (*RawData, uint64, error) {
+	t.Helper()
+
+	handler, err := BuiltinFunctionV2(bind.Type, operator)
+	require.NoError(t, err)
+
+	return handler.f(newTestBlockExecutor(), bind, newStringKeyChunk(), 0)
+}
+
+func TestDictGetIndex_NilValue(t *testing.T) {
+	for _, operator := range []string{"[]", "[]?"} {
+		t.Run(operator+" returns typed null when parent dict is nil", func(t *testing.T) {
+			bind := &RawData{Type: types.Dict, Value: nil}
+
+			res, ref, err := runIndexHandler(t, bind, operator)
+			require.NoError(t, err)
+			assert.Equal(t, uint64(0), ref)
+			assert.Equal(t, types.Dict, res.Type)
+			assert.Nil(t, res.Value, "null dict access should propagate null, not error")
+		})
+	}
+}
+
+func TestMapGetIndex_NilValue(t *testing.T) {
+	for _, operator := range []string{"[]", "[]?"} {
+		t.Run(operator+" returns typed null when parent map is nil", func(t *testing.T) {
+			mapType := types.Map(types.String, types.String)
+			bind := &RawData{Type: mapType, Value: nil}
+
+			res, ref, err := runIndexHandler(t, bind, operator)
+			require.NoError(t, err)
+			assert.Equal(t, uint64(0), ref)
+			assert.Equal(t, types.String, res.Type)
+			assert.Nil(t, res.Value, "null map access should propagate null, not error")
+		})
+	}
+}