You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Fact with more than 4 elements: elements after the valid-time map are silently dropped #649
parse_transact accepts a fact with more than four elements when the fourth is a map, and drops everything after the map without an error:
(transact [[:alice :person/age 1 {} 99 :junk]])
succeeds and stores only [:alice :person/age 1]. A caller who builds a fact with a misplaced bracket (for example two facts run together) loses data silently.
Affected: every release from v0.4.0 (per-fact valid-time maps) through v2.0.8, and v3. Before v0.4.0, Pattern::from_edn required exactly three elements.
Cause:parse_transact checks fact_vec.len() < 3 and reads fact_vec.get(3) as the optional map, but never checks the length is at most 4.
Workaround: none needed for well-formed input; check that each fact vector has 3 elements, or 4 with a map last.
Fix
Reject a fact of more than four elements with its own PRS code (v3), and the same check on main for a v2.0.x patch.
Found by the grammar verifier (#643): it is the FactArity entry of
10760
KNOWN_DRIFT in src/query/datalog/parser/verifier.rs, which the fix removes. grammar.pest's fact is now exact ([e a v valid_time_map?]).
Fixed on v3 in #654 (aa36639) and backported to main in #656 (5f364ab): a fact of more than four elements now fails with PRS-108 and the transaction writes nothing. Stays open until v2.0.9 is published.
Activity
Merge pull request #654 from project-minigraf/fix/649-fact-arity
fix(parser): reject a fact with more than four elements, PRS-108 (#649)…
adityamukho commentedon Oct 20, 2026
Fixed on v3 in #654 (aa36639) and backported to main in #656 (5f364ab): a fact of more than four elements now fails with
PRS-108and the transaction writes nothing. Stays open until v2.0.9 is published.release: v2.0.9
adityamukho commentedon Oct 21, 2026
Fixed in v2.0.9 (released 2026-10-21, on crates.io) and in v3.0.0. Listed under "Fixed in v2.0.9" in #421.