Fix type-checker and runtime to properly resolve global escaped identifiers

PiperOrigin-RevId: 856748731

Author: l46kok

.gitignore

@@ -31,3 +31,5 @@ mvn-artifacts
 
 *.swp
 *.lock
+.eclipse
+.vscode

checker/src/main/java/dev/cel/checker/Env.java

@@ -451,17 +451,29 @@ public Env add(String name, Type type) {
    * until the root package is reached. If {@code container} starts with {@code .}, the resolution
    * is in the root container only.
    *
-   * <p>Returns {@code null} if the function cannot be found.
+   * <p>Returns {@code null} if the ident cannot be found.
    */
   public @Nullable CelIdentDecl tryLookupCelIdent(CelContainer container, String name) {
-    // Attempt to find the decl with just the ident name to account for shadowed variables
-    CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(name);
-    if (decl != null) {
-      return decl;
+    // A name with a leading '.' always resolves in the root scope, bypassing local scopes.
+    if (!name.startsWith(".")) {
+      // Check if this is a qualified ident, or a field selection.
+      String simpleName = name;
+      int dotIndex = name.indexOf('.');
+      if (dotIndex > 0) {
+        simpleName = name.substring(0, dotIndex);
+      }
+
+      // Attempt to find the decl with just the ident name to account for shadowed variables.
+      CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(simpleName);
+      if (decl != null) {
+        // Appears to be a field selection on a local.
+        // Return null instead of attempting to resolve qualified name at the root scope
+        return dotIndex > 0 ? null : decl;
+      }
     }
 
     for (String cand : container.resolveCandidateNames(name)) {
-      decl = tryLookupCelIdent(cand);
+      CelIdentDecl decl = tryLookupCelIdent(cand);
       if (decl != null) {
         return decl;
       }
@@ -503,7 +515,13 @@ public Env add(String name, Type type) {
     return null;
   }
 
-  private @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
+  /**
+   * Lookup a local identifier by name. This searches only comprehension scopes, bypassing standard
+   * environment or user-defined environment.
+   *
+   * <p>Returns {@code null} if not found in local scopes.
+   */
+  @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
     int firstUserSpaceScope = 2;
     // Iterate from the top of the stack down to the first local scope.
     // Note that:

checker/src/main/java/dev/cel/checker/ExprChecker.java

@@ -237,15 +237,18 @@ private CelExpr visit(CelExpr expr, CelExpr.CelIdent ident) {
     if (decl.equals(Env.ERROR_IDENT_DECL)) {
       // error reported
       env.setType(expr, SimpleType.ERROR);
-      env.setRef(expr, makeReference(decl));
+      env.setRef(expr, makeReference(decl.name(), decl));
       return expr;
     }
-    if (!decl.name().equals(ident.name())) {
+
+    String refName = maybeDisambiguate(ident.name(), decl.name());
+
+    if (!refName.equals(ident.name())) {
       // Overwrite the identifier with its fully qualified name.
-      expr = replaceIdentSubtree(expr, decl.name());
+      expr = replaceIdentSubtree(expr, refName);
     }
     env.setType(expr, decl.type());
-    env.setRef(expr, makeReference(decl));
+    env.setRef(expr, makeReference(refName, decl));
     return expr;
   }
 
@@ -260,13 +263,15 @@ private CelExpr visit(CelExpr expr, CelExpr.CelSelect select) {
           env.reportError(expr.id(), getPosition(expr), "expression does not select a field");
           env.setType(expr, SimpleType.BOOL);
         } else {
+          String refName = maybeDisambiguate(qname, decl.name());
+
           if (namespacedDeclarations) {
             // Rewrite the node to be a variable reference to the resolved fully-qualified
             // variable name.
-            expr = replaceIdentSubtree(expr, decl.name());
+            expr = replaceIdentSubtree(expr, refName);
           }
           env.setType(expr, decl.type());
-          env.setRef(expr, makeReference(decl));
+          env.setRef(expr, makeReference(refName, decl));
         }
         return expr;
       }
@@ -595,14 +600,32 @@ private CelExpr visit(CelExpr expr, CelExpr.CelComprehension compre) {
     return expr;
   }
 
-  private CelReference makeReference(CelIdentDecl decl) {
-    CelReference.Builder ref = CelReference.newBuilder().setName(decl.name());
+  private CelReference makeReference(String name, CelIdentDecl decl) {
+    CelReference.Builder ref = CelReference.newBuilder().setName(name);
     if (decl.constant().isPresent()) {
       ref.setValue(decl.constant().get());
     }
     return ref.build();
   }
 
+  /**
+   * Returns the reference name, prefixed with a leading dot only if disambiguation is needed.
+   * Disambiguation is needed when: the original name had a leading dot, and there's a local
+   * variable that would shadow the resolved name.
+   */
+  private String maybeDisambiguate(String originalName, String resolvedName) {
+    if (!originalName.startsWith(".")) {
+      return resolvedName;
+    }
+    String simpleName = originalName.substring(1);
+    int dotIndex = simpleName.indexOf('.');
+    String localName = dotIndex > 0 ? simpleName.substring(0, dotIndex) : simpleName;
+    if (env.tryLookupCelIdentFromLocalScopes(localName) != null) {
+      return "." + resolvedName;
+    }
+    return resolvedName;
+  }
+
   private OverloadResolution resolveOverload(
       long callExprId,
       int position,

checker/src/test/java/dev/cel/checker/ExprCheckerTest.java

@@ -199,6 +199,10 @@ public void referenceTypeRelative() throws Exception {
   public void referenceTypeAbsolute() throws Exception {
     source = ".cel.expr.conformance.proto3.TestAllTypes";
     runTest();
+
+    declareVariable("app.config", SimpleType.INT);
+    source = "[0].exists(app, .app.config == 1)";
+    runTest();
   }
 
   @Test

checker/src/test/resources/referenceTypeAbsolute.baseline

@@ -1,3 +1,36 @@
 Source: .cel.expr.conformance.proto3.TestAllTypes
 =====>
 cel.expr.conformance.proto3.TestAllTypes~type(cel.expr.conformance.proto3.TestAllTypes)^cel.expr.conformance.proto3.TestAllTypes
+
+Source: [0].exists(app, .app.config == 1)
+declare app.config {
+  value int
+}
+=====>
+__comprehension__(
+  // Variable
+  app,
+  // Target
+  [
+    0~int
+  ]~list(int),
+  // Accumulator
+  @result,
+  // Init
+  false~bool,
+  // LoopCondition
+  @not_strictly_false(
+    !_(
+      @result~bool^@result
+    )~bool^logical_not
+  )~bool^not_strictly_false,
+  // LoopStep
+  _||_(
+    @result~bool^@result,
+    _==_(
+      .app.config~int^.app.config,
+      1~int
+    )~bool^equals
+  )~bool^logical_or,
+  // Result
+  @result~bool^@result)~bool

runtime/src/main/java/dev/cel/runtime/RuntimeUnknownResolver.java

@@ -98,6 +98,11 @@ Optional<AccumulatedUnknowns> maybePartialUnknown(CelAttribute attribute) {
 
   /** Resolve a simple name to a value. */
   DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+    // Strip leading dot if present (for global disambiguation).
+    if (name.startsWith(".")) {
+      name = name.substring(1);
+    }
+
     CelAttribute attr = CelAttribute.EMPTY;
 
     if (attributeTrackingEnabled) {
@@ -154,6 +159,10 @@ private ScopedResolver(
 
     @Override
     DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+      // A name with a leading '.' always resolves in the root scope
+      if (name.startsWith(".")) {
+        return parent.resolveSimpleName(name, exprId);
+      }
       DefaultInterpreter.IntermediateResult result = lazyEvalResultCache.get(name);
       if (result != null) {
         return copyIfMutable(result);

runtime/src/test/resources/comprehension.baseline

@@ -19,4 +19,36 @@ declare com.x {
 }
 =====>
 bindings: {com.x=1}
-result:   true
+result:   true
+
+Source: [{'z': 0}].exists(y, y.z == 0)
+declare cel.example.y {
+  value int
+}
+=====>
+bindings: {cel.example.y={z=1}}
+result:   true
+
+Source: [{'z': 0}].exists(y, y.z == 0 && .y.z == 1)
+declare y.z {
+  value int
+}
+=====>
+bindings: {y.z=1}
+result:   true
+
+Source: [0].exists(x, x == 0 && .x == 1)
+declare x {
+  value int
+}
+=====>
+bindings: {x=1}
+result:   true
+
+Source: [0].exists(x, [x+1].exists(x, x == .x))
+declare x {
+  value int
+}
+=====>
+bindings: {x=1}
+result:   true

testing/src/main/java/dev/cel/testing/BaseInterpreterTest.java

@@ -863,6 +863,26 @@ public void comprehension() throws Exception {
     container = CelContainer.ofName("com");
     source = "[0].exists(x, x == 0)";
     runTest(ImmutableMap.of("com.x", 1));
+
+    clearAllDeclarations();
+    declareVariable("cel.example.y", SimpleType.INT);
+    container = CelContainer.ofName("cel.example");
+    source = "[{'z': 0}].exists(y, y.z == 0)";
+    runTest(ImmutableMap.of("cel.example.y", ImmutableMap.of("z", 1)));
+
+    clearAllDeclarations();
+    declareVariable("y.z", SimpleType.INT);
+    container = CelContainer.ofName("y");
+    source = "[{'z': 0}].exists(y, y.z == 0 && .y.z == 1)";
+    runTest(ImmutableMap.of("y.z", 1));
+
+    clearAllDeclarations();
+    declareVariable("x", SimpleType.INT);
+    source = "[0].exists(x, x == 0 && .x == 1)";
+    runTest(ImmutableMap.of("x", 1));
+
+    source = "[0].exists(x, [x+1].exists(x, x == .x))";
+    runTest(ImmutableMap.of("x", 1));
   }
 
   @Test