fix: propagate null through dict and map bracket access

Change dict [] and map [] operators to propagate null when the parent
element is nil, instead of returning a runtime error. This aligns the
behavior of [] with the existing []? (conditional access) operator.

Before this change, expressions like:
  dict["domain"]["key"]
would fail with "cannot access field key, parent element is null"
when the parent key did not exist in the dict/map.

After this change, the expression evaluates to null, which then
correctly evaluates to false in boolean comparisons. This is the
expected behavior for dict/map chains where intermediate keys may
not be present.

The []? operator already had this behavior; now [] matches it.
The isConditional parameter is removed since both paths are identical.

Author: syrull

llx/builtin_map.go

@@ -18,14 +18,14 @@ import (
 var mapFunctions map[string]chunkHandlerV2 //nolint:unused
 
 func mapGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
-	return _mapGetIndex(e, bind, chunk, ref, false)
+	return _mapGetIndex(e, bind, chunk, ref)
 }
 
 func mapGetConditionalIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
-	return _mapGetIndex(e, bind, chunk, ref, true)
+	return _mapGetIndex(e, bind, chunk, ref)
 }
 
-func _mapGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64, isConditional bool) (*RawData, uint64, error) {
+func _mapGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
 	args := chunk.Function.Args
 	// TODO: all this needs to go into the compile phase
 	if len(args) < 1 {
@@ -37,12 +37,8 @@ func _mapGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64, isC
 	// ^^ TODO
 
 	if bind.Value == nil {
-		if isConditional {
-			return &RawData{Type: bind.Type.Child()}, 0, nil
-		} else {
-			field := args[0].LabelV2(e.ctx.code)
-			return nil, 0, errors.New("cannot access map field " + field + ", map is null")
-		}
+		// Propagate null through map access chains instead of erroring.
+		return &RawData{Type: bind.Type.Child()}, 0, nil
 	}
 
 	var key string
@@ -372,14 +368,14 @@ func mapValuesV2(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*Ra
 }
 
 func dictGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
-	return _dictGetIndex(e, bind, chunk, ref, false)
+	return _dictGetIndex(e, bind, chunk, ref)
 }
 
 func dictGetConditionalIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
-	return _dictGetIndex(e, bind, chunk, ref, true)
+	return _dictGetIndex(e, bind, chunk, ref)
 }
 
-func _dictGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64, isConditional bool) (*RawData, uint64, error) {
+func _dictGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64) (*RawData, uint64, error) {
 	args := chunk.Function.Args
 	// TODO: all this needs to go into the compile phase
 	if len(args) < 1 {
@@ -390,12 +386,10 @@ func _dictGetIndex(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64, is
 	}
 
 	if bind.Value == nil {
-		if isConditional {
-			return &RawData{Type: bind.Type}, 0, nil
-		} else {
-			field := args[0].LabelV2(e.ctx.code)
-			return nil, 0, errors.New("cannot access field " + field + ", parent element is null")
-		}
+		// Propagate null through dict access chains instead of erroring.
+		// This enables expressions like dict['a']['b'] to evaluate to null
+		// when dict['a'] is nil, rather than failing with a runtime error.
+		return &RawData{Type: bind.Type}, 0, nil
 	}
 
 	switch x := bind.Value.(type) {

llx/builtin_map_test.go

@@ -0,0 +1,74 @@
+// Copyright (c) Mondoo, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package llx
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.mondoo.com/mql/v13/types"
+)
+
+func newTestBlockExecutor() *blockExecutor {
+	return &blockExecutor{
+		ctx: &MQLExecutorV2{code: &CodeV2{}},
+	}
+}
+
+func newStringKeyChunk() *Chunk {
+	return &Chunk{
+		Function: &Function{
+			Args: []*Primitive{{Value: []byte("key"), Type: string(types.String)}},
+		},
+	}
+}
+
+func TestDictGetIndex_NilValue(t *testing.T) {
+	t.Run("returns typed null when parent dict is nil", func(t *testing.T) {
+		e := newTestBlockExecutor()
+		bind := &RawData{Type: types.Dict, Value: nil}
+
+		res, ref, err := dictGetIndex(e, bind, newStringKeyChunk(), 0)
+		require.NoError(t, err)
+		assert.Equal(t, uint64(0), ref)
+		assert.Equal(t, types.Dict, res.Type)
+		assert.Nil(t, res.Value, "null dict access should propagate null, not error")
+	})
+
+	t.Run("conditional index also returns typed null", func(t *testing.T) {
+		e := newTestBlockExecutor()
+		bind := &RawData{Type: types.Dict, Value: nil}
+
+		res, ref, err := dictGetConditionalIndex(e, bind, newStringKeyChunk(), 0)
+		require.NoError(t, err)
+		assert.Equal(t, uint64(0), ref)
+		assert.Equal(t, types.Dict, res.Type)
+		assert.Nil(t, res.Value, "conditional null dict access should propagate null")
+	})
+}
+
+func TestMapGetIndex_NilValue(t *testing.T) {
+	t.Run("returns typed null when parent map is nil", func(t *testing.T) {
+		e := newTestBlockExecutor()
+		mapType := types.Map(types.String, types.String)
+		bind := &RawData{Type: mapType, Value: nil}
+
+		res, ref, err := mapGetIndex(e, bind, newStringKeyChunk(), 0)
+		require.NoError(t, err)
+		assert.Equal(t, uint64(0), ref)
+		assert.Nil(t, res.Value, "null map access should propagate null, not error")
+	})
+
+	t.Run("conditional index also returns typed null", func(t *testing.T) {
+		e := newTestBlockExecutor()
+		mapType := types.Map(types.String, types.String)
+		bind := &RawData{Type: mapType, Value: nil}
+
+		res, ref, err := mapGetConditionalIndex(e, bind, newStringKeyChunk(), 0)
+		require.NoError(t, err)
+		assert.Equal(t, uint64(0), ref)
+		assert.Nil(t, res.Value, "conditional null map access should propagate null")
+	})
+}