Skip to content

Conversation

jblomer
Copy link
Contributor

@jblomer jblomer commented Sep 12, 2025

Several RFieldBase descendants still allow for passing the type name in a public constructor. This is dangerous as it potentially allows to write arbitrary type names to disk. Remove / rework these constructors.

@jblomer jblomer self-assigned this Sep 12, 2025
@jblomer jblomer force-pushed the ntuple-fix-field-constructors branch from cb3a737 to 4d80ea9 Compare September 12, 2025 13:17
std::unique_ptr<RFieldBase> itemField)
: ROOT::RFieldBase(fieldName, typeName, ROOT::ENTupleStructure::kCollection, false /* isSimple */)
: ROOT::RFieldBase(fieldName, typePrefix + "<" + itemField->GetTypeName() + ">", ROOT::ENTupleStructure::kCollection,
Copy link
Member

@pcanal pcanal Sep 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As implied by:

This is dangerous as it potentially allows to write arbitrary type names to disk.

doesn't the 'prefix' then also need to be normalized? (At least here) wasn't the 'real' issue that the 2 types (typeName and the one derived from itemField->GetTypeName() being potentially different?

Copy link
Contributor Author

@jblomer jblomer Sep 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, because the constructor that accepts a prefix is protected. I could have used the full type name instead of the type prefix approach. The reason I didn't is that the code calling this constructor would then both get the type name from the item field and move the item field to the base class. And doing both these things in a single call is illegal.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wasn't the previous constructor also protected?

Copy link

github-actions bot commented Sep 12, 2025

Test Results

    20 files      20 suites   3d 14h 48m 57s ⏱️
 3 661 tests  3 660 ✅ 0 💤 1 ❌
71 513 runs  71 507 ✅ 5 💤 1 ❌

For more details on these failures, see this check.

Results for commit 4d80ea9.

♻️ This comment has been updated with latest results.

Copy link
Member

@pcanal pcanal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants