Optimize composed policies using Constant Folding and Common Subexpression Elimination#793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
copybara-service merged 1 commit into from
Sep 2, 2025
Merged

Optimize composed policies using Constant Folding and Common Subexpression Elimination #793

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion optimizer/src/main/java/dev/cel/optimizer/optimizers/ConstantFoldingOptimizer.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,7 @@
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.ast.CelMutableExpr;
import dev.cel.common.ast.CelMutableExpr.CelMutableCall;
import dev.cel.common.ast.CelMutableExpr.CelMutableComprehension;
import dev.cel.common.ast.CelMutableExpr.CelMutableList;
import dev.cel.common.ast.CelMutableExpr.CelMutableMap;
import dev.cel.common.ast.CelMutableExpr.CelMutableStruct;
Expand DownExpand Up@@ -202,7 +203,11 @@ private static boolean canFoldInOperator(CelNavigableMutableExpr navigableExpr)
CelNavigableMutableExpr parent = identNode.parent().orElse(null);
while (parent != null) {
if (parent.getKind().equals(Kind.COMPREHENSION)) {
if (parent.expr().comprehension().accuVar().equals(identNode.expr().ident().name())) {
String identName = identNode.expr().ident().name();
CelMutableComprehension parentComprehension = parent.expr().comprehension();
if (parentComprehension.accuVar().equals(identName)
|| parentComprehension.iterVar().equals(identName)
|| parentComprehension.iterVar2().equals(identName)) {
// Prevent folding a subexpression if it contains a variable declared by a
// comprehension. The subexpression cannot be compiled without the full context of the
// surrounding comprehension.
Expand Down
2 changes: 1 addition & 1 deletion parser/src/main/java/dev/cel/parser/Operator.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -180,7 +180,7 @@ static Optional<Operator> find(String text) {
.put(MODULO.getFunction(), "%")
.buildOrThrow();

/** Lookup an operator by its mangled name, as used within the AST. */
/** Lookup an operator by its mangled name (ex: _&&_), as used within the AST. */
public static Optional<Operator> findReverse(String op) {
return Optional.ofNullable(REVERSE_OPERATORS.get(op));
}
Expand Down
4 changes: 4 additions & 0 deletions policy/src/main/java/dev/cel/policy/BUILD.bazel
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -215,6 +215,8 @@ java_library(
"//optimizer",
"//optimizer:optimization_exception",
"//optimizer:optimizer_builder",
"//optimizer/optimizers:common_subexpression_elimination",
"//optimizer/optimizers:constant_folding",
"//validator",
"//validator:ast_validator",
"//validator:validator_builder",
Expand DownExpand Up@@ -247,7 +249,9 @@ java_library(
"//common:cel_ast",
"//common:compiler_common",
"//common:mutable_ast",
"//common/ast",
"//common/formats:value_string",
"//common/navigation:mutable_navigation",
"//extensions:optional_library",
"//optimizer:ast_optimizer",
"//optimizer:mutable_ast",
Expand Down
29 changes: 27 additions & 2 deletions policy/src/main/java/dev/cel/policy/CelPolicyCompilerImpl.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,6 +36,9 @@
import dev.cel.optimizer.CelOptimizationException;
import dev.cel.optimizer.CelOptimizer;
import dev.cel.optimizer.CelOptimizerFactory;
import dev.cel.optimizer.optimizers.ConstantFoldingOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer.SubexpressionOptimizerOptions;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result.Kind;
Expand DownExpand Up@@ -98,7 +101,7 @@ public CelCompiledRule compileRule(CelPolicy policy) throws CelPolicyValidationE
public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledRule)
throws CelPolicyValidationException {
Cel cel = compiledRule.cel();
CelOptimizer optimizer =
CelOptimizer composingOptimizer =
CelOptimizerFactory.standardCelOptimizerBuilder(cel)
.addAstOptimizers(
RuleComposer.newInstance(compiledRule, variablesPrefix, iterationLimit))
Expand All@@ -110,7 +113,7 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
// This is a minimal expression used as a basis of stitching together all the rules into a
// single graph.
ast = cel.compile("true").getAst();
ast = optimizer.optimize(ast);
ast = composingOptimizer.optimize(ast);
} catch (CelValidationException | CelOptimizationException e) {
if (e.getCause() instanceof RuleCompositionException) {
RuleCompositionException re = (RuleCompositionException) e.getCause();
Expand All@@ -136,6 +139,28 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
throw new CelPolicyValidationException("Unexpected error while composing rules.", e);
}

CelOptimizer astOptimizer =
CelOptimizerFactory.standardCelOptimizerBuilder(cel)
.addAstOptimizers(
ConstantFoldingOptimizer.getInstance(),
SubexpressionOptimizer.newInstance(
SubexpressionOptimizerOptions.newBuilder()
// "record" is used for recording subexpression results via
// BlueprintLateFunctionBinding. Safely eliminable, since repeated
// invocation does not change the intermediate results.
.addEliminableFunctions("record")
.populateMacroCalls(true)
.enableCelBlock(true)
.build()))
.build();
try {
// Optimize the composed graph using const fold and CSE
ast = astOptimizer.optimize(ast);
} catch (CelOptimizationException e) {
throw new CelPolicyValidationException(
"Failed to optimize the composed policy. Reason: " + e.getMessage(), e);
}

assertAstDepthIsSafe(ast, cel);

return ast;
Expand Down
40 changes: 29 additions & 11 deletions policy/src/main/java/dev/cel/policy/RuleComposer.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -19,12 +19,16 @@
import static java.util.stream.Collectors.toCollection;

import com.google.auto.value.AutoValue;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Lists;
import dev.cel.bundle.Cel;
import dev.cel.common.CelAbstractSyntaxTree;
import dev.cel.common.CelMutableAst;
import dev.cel.common.CelValidationException;
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.formats.ValueString;
import dev.cel.common.navigation.CelNavigableMutableAst;
import dev.cel.common.navigation.CelNavigableMutableExpr;
import dev.cel.extensions.CelOptionalLibrary.Function;
import dev.cel.optimizer.AstMutator;
import dev.cel.optimizer.CelAstOptimizer;
Expand DownExpand Up@@ -151,23 +155,37 @@ private RuleOptimizationResult optimizeRule(Cel cel, CelCompiledRule compiledRul
}
}

CelMutableAst result = matchAst;
for (CelCompiledVariable variable : Lists.reverse(compiledRule.variables())) {
result =
astMutator.replaceSubtreeWithNewBindMacro(
result,
variablePrefix + variable.name(),
CelMutableAst.fromCelAst(variable.ast()),
result.expr(),
result.expr().id(),
true);
}
CelMutableAst result = inlineCompiledVariables(matchAst, compiledRule.variables());

result = astMutator.renumberIdsConsecutively(result);

return RuleOptimizationResult.create(result, isOptionalResult);
}

private CelMutableAst inlineCompiledVariables(
CelMutableAst ast, List<CelCompiledVariable> compiledVariables) {
CelMutableAst mutatedAst = ast;
for (CelCompiledVariable compiledVariable : Lists.reverse(compiledVariables)) {
String variableName = variablePrefix + compiledVariable.name();
ImmutableList<CelNavigableMutableExpr> exprsToReplace =
CelNavigableMutableAst.fromAst(mutatedAst)
.getRoot()
.allNodes()
.filter(
node ->
node.expr().getKind().equals(Kind.IDENT)
&& node.expr().ident().name().equals(variableName))
.collect(toImmutableList());

for (CelNavigableMutableExpr expr : exprsToReplace) {
CelMutableAst variableAst = CelMutableAst.fromCelAst(compiledVariable.ast());
mutatedAst = astMutator.replaceSubtree(mutatedAst, variableAst, expr.id());
}
}

return mutatedAst;
}

static RuleComposer newInstance(
CelCompiledRule compiledRule, String variablePrefix, int iterationLimit) {
return new RuleComposer(compiledRule, variablePrefix, iterationLimit);
Expand Down
32 changes: 28 additions & 4 deletions policy/src/test/java/dev/cel/policy/CelPolicyCompilerImplTest.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -136,8 +136,8 @@ public void compileYamlPolicy_multilineContainsError_throws(

@Test
public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Exception {
String longExpr =
"0+1+2+3+4+5+6+7+8+9+10+11+12+13+14+15+16+17+18+19+20+21+22+23+24+25+26+27+28+29+30+31+32+33+34+35+36+37+38+39+40+41+42+43+44+45+46+47+48+49+50";
Cel cel = newCel().toCelBuilder().addVar("msg", SimpleType.DYN).build();
String longExpr = "msg.b.c.d.e.f";
String policyContent =
String.format(
"name: deeply_nested_ast\n" + "rule:\n" + " match:\n" + " - output: %s", longExpr);
Expand All@@ -146,11 +146,35 @@ public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Except
CelPolicyValidationException e =
assertThrows(
CelPolicyValidationException.class,
() -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
() ->
CelPolicyCompilerFactory.newPolicyCompiler(cel)
.setAstDepthLimit(5)
.build()
.compile(policy));

assertThat(e)
.hasMessageThat()
.isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 5.");
}

@Test
public void compileYamlPolicy_constantFoldingFailure_throwsDuringComposition() throws Exception {
String policyContent =
"name: ast_with_div_by_zero\n" //
+ "rule:\n" //
+ " match:\n" //
+ " - output: 1 / 0";
CelPolicy policy = POLICY_PARSER.parse(policyContent);

CelPolicyValidationException e =
assertThrows(
CelPolicyValidationException.class,
() -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
assertThat(e)
.hasMessageThat()
.isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 50.");
.isEqualTo(
"Failed to optimize the composed policy. Reason: Constant folding failure. Failed to"
+ " evaluate subtree due to: evaluation error: / by zero");
}

@Test
Expand Down
100 changes: 40 additions & 60 deletions policy/src/test/java/dev/cel/policy/PolicyTestHelper.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -41,88 +41,68 @@ enum TestYamlPolicy {
NESTED_RULE(
"nested_rule",
true,
"cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
+ " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
+ " (resource.origin in variables.banned_regions && "
+ "!(resource.origin in variables.permitted_regions)) "
+ "? optional.of({\"banned\": true}) : optional.none()).or("
+ "optional.of((resource.origin in variables.permitted_regions)"
+ " ? {\"banned\": false} : {\"banned\": true})))"),
"cel.@block([resource.origin, @index0 in [\"us\", \"uk\", \"es\"], {\"banned\": true}],"
+ " ((@index0 in {\"us\": false, \"ru\": false, \"ir\": false} && !@index1) ?"
+ " optional.of(@index2) : optional.none()).or(optional.of(@index1 ? {\"banned\":"
+ " false} : @index2)))"),
NESTED_RULE2(
"nested_rule2",
false,
"cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
+ " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
+ " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
+ " (resource.origin in variables.banned_regions && !(resource.origin in"
+ " variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} : {\"banned\":"
+ " \"bad_actor\"}) : (!(resource.origin in variables.permitted_regions) ? {\"banned\":"
+ " \"unconfigured_region\"} : {}))"),
"cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
+ " resource.?user.orValue(\"\").startsWith(\"bad\") ? ((@index0 in {\"us\": false,"
+ " \"ru\": false, \"ir\": false} && @index1) ? {\"banned\": \"restricted_region\"} :"
+ " {\"banned\": \"bad_actor\"}) : (@index1 ? {\"banned\": \"unconfigured_region\"} :"
+ " {}))"),
NESTED_RULE3(
"nested_rule3",
true,
"cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
+ " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
+ " optional.of(cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false,"
+ " \"ir\": false}, (resource.origin in variables.banned_regions && !(resource.origin"
+ " in variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} :"
+ " {\"banned\": \"bad_actor\"})) : (!(resource.origin in variables.permitted_regions)"
+ " ? optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
"cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
+ " resource.?user.orValue(\"\").startsWith(\"bad\") ? optional.of((@index0 in {\"us\":"
+ " false, \"ru\": false, \"ir\": false} && @index1) ? {\"banned\":"
+ " \"restricted_region\"} : {\"banned\": \"bad_actor\"}) : (@index1 ?"
+ " optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
REQUIRED_LABELS(
"required_labels",
true,
""
+ "cel.bind(variables.want, spec.labels, cel.bind(variables.missing, "
+ "variables.want.filter(l, !(l in resource.labels)), cel.bind(variables.invalid, "
+ "resource.labels.filter(l, l in variables.want && variables.want[l] != "
+ "resource.labels[l]), (variables.missing.size() > 0) ? "
+ "optional.of(\"missing one or more required labels: [\"\" + "
+ "variables.missing.join(\",\") + \"\"]\") : ((variables.invalid.size() > 0) ? "
+ "optional.of(\"invalid values provided on one or more labels: [\"\" + "
+ "variables.invalid.join(\",\") + \"\"]\") : optional.none()))))"),
"cel.@block([spec.labels.filter(@it:0:0, !(@it:0:0 in resource.labels)), spec.labels,"
+ " resource.labels, @index2.filter(@it:0:0, @it:0:0 in @index1 && @index1[@it:0:0] !="
+ " @index2[@it:0:0])], (@index0.size() > 0) ? optional.of(\"missing one or more"
+ " required labels: [\"\" + @index0.join(\",\") + \"\"]\") : ((@index3.size() > 0) ?"
+ " optional.of(\"invalid values provided on one or more labels: [\"\" +"
+ " @index3.join(\",\") + \"\"]\") : optional.none()))"),
RESTRICTED_DESTINATIONS(
"restricted_destinations",
false,
"cel.bind(variables.matches_origin_ip, locationCode(origin.ip) == spec.origin,"
+ " cel.bind(variables.has_nationality, has(request.auth.claims.nationality),"
+ " cel.bind(variables.matches_nationality, variables.has_nationality &&"
+ " request.auth.claims.nationality == spec.origin, cel.bind(variables.matches_dest_ip,"
+ " locationCode(destination.ip) in spec.restricted_destinations,"
+ " cel.bind(variables.matches_dest_label, resource.labels.location in"
+ " spec.restricted_destinations, cel.bind(variables.matches_dest,"
+ " variables.matches_dest_ip || variables.matches_dest_label,"
+ " (variables.matches_nationality && variables.matches_dest) ? true :"
+ " ((!variables.has_nationality && variables.matches_origin_ip &&"
+ " variables.matches_dest) ? true : false)))))))"),
"cel.@block([request.auth.claims, has(@index0.nationality), resource.labels.location in"
+ " spec.restricted_destinations], (@index1 && @index0.nationality == spec.origin &&"
+ " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
+ " ((!@index1 && locationCode(origin.ip) == spec.origin &&"
+ " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
+ " false))"),
K8S(
"k8s",
true,
"cel.bind(variables.env, resource.labels.?environment.orValue(\"prod\"),"
+ " cel.bind(variables.break_glass, resource.labels.?break_glass.orValue(\"false\") =="
+ " \"true\", !(variables.break_glass || resource.containers.all(c,"
+ " c.startsWith(variables.env + \".\"))) ? optional.of(\"only \" + variables.env + \""
+ " containers are allowed in namespace \" + resource.namespace) :"
+ " optional.none()))"),
"cel.@block([resource.labels.?environment.orValue(\"prod\")],"
+ " !(resource.labels.?break_glass.orValue(\"false\") == \"true\" ||"
+ " resource.containers.all(@it:0:0, @it:0:0.startsWith(@index0 + \".\"))) ?"
+ " optional.of(\"only \" + @index0 + \" containers are allowed in namespace \" +"
+ " resource.namespace) : optional.none())"),
PB(
"pb",
true,
"(spec.single_int32 > TestAllTypes{single_int64: 10}.single_int64) ? optional.of(\"invalid"
+ " spec, got single_int32=\" + string(spec.single_int32) + \", wanted <= 10\") :"
+ " ((spec.standalone_enum == cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR"
+ " || dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
"cel.@block([spec.single_int32], (@index0 > 10) ? optional.of(\"invalid spec, got"
+ " single_int32=\" + string(@index0) + \", wanted <= 10\") : ((spec.standalone_enum =="
+ " cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR ||"
+ " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
+ " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGOO) ? optional.of(\"invalid"
+ " spec, neither nested nor imported enums may refer to BAR\") :"
+ " optional.none())"),
+ " spec, neither nested nor imported enums may refer to BAR\") : optional.none()))"),
LIMITS(
"limits",
true,
"cel.bind(variables.greeting, \"hello\", cel.bind(variables.farewell, \"goodbye\","
+ " cel.bind(variables.person, \"me\", cel.bind(variables.message_fmt, \"%s, %s\","
+ " (now.getHours() >= 20) ? cel.bind(variables.message, variables.farewell + \", \" +"
+ " variables.person, (now.getHours() < 21) ? optional.of(variables.message + \"!\") :"
+ " ((now.getHours() < 22) ? optional.of(variables.message + \"!!\") : ((now.getHours()"
+ " < 24) ? optional.of(variables.message + \"!!!\") : optional.none()))) :"
+ " optional.of(variables.greeting + \", \" + variables.person)))))");
"cel.@block([now.getHours()], (@index0 >= 20) ? ((@index0 < 21) ? optional.of(\"goodbye,"
+ " me!\") : ((@index0 < 22) ? optional.of(\"goodbye, me!!\") : ((@index0 < 24) ?"
+ " optional.of(\"goodbye, me!!!\") : optional.none()))) : optional.of(\"hello,"
+ " me\"))");

private final String name;
private final boolean producesOptionalResult;
Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Optimize composed policies using Constant Folding and Common Subexpression Elimination#793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

copybara-service
merged 1 commit into

from

Sep 2, 2025
 Merged


Optimize composed policies using Constant Folding and Common Subexpression Elimination
#793
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 6 additions & 1 deletion
optimizer/src/main/java/dev/cel/optimizer/optimizers/ConstantFoldingOptimizer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,7 @@
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.ast.CelMutableExpr;
import dev.cel.common.ast.CelMutableExpr.CelMutableCall;
import dev.cel.common.ast.CelMutableExpr.CelMutableComprehension;
import dev.cel.common.ast.CelMutableExpr.CelMutableList;
import dev.cel.common.ast.CelMutableExpr.CelMutableMap;
import dev.cel.common.ast.CelMutableExpr.CelMutableStruct;
Expand DownExpand Up@@ -202,7 +203,11 @@ private static boolean canFoldInOperator(CelNavigableMutableExpr navigableExpr)
 CelNavigableMutableExpr parent = identNode.parent().orElse(null);
 while (parent != null) {
 if (parent.getKind().equals(Kind.COMPREHENSION)) {
 if (parent.expr().comprehension().accuVar().equals(identNode.expr().ident().name())) {
 String identName = identNode.expr().ident().name();
 CelMutableComprehension parentComprehension = parent.expr().comprehension();
 if (parentComprehension.accuVar().equals(identName)
 || parentComprehension.iterVar().equals(identName)
 || parentComprehension.iterVar2().equals(identName)) {
 // Prevent folding a subexpression if it contains a variable declared by a
 // comprehension. The subexpression cannot be compiled without the full context of the
 // surrounding comprehension.
Expand Down

2 changes: 1 addition & 1 deletion
parser/src/main/java/dev/cel/parser/Operator.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -180,7 +180,7 @@ static Optional<Operator> find(String text) {
 .put(MODULO.getFunction(), "%")
 .buildOrThrow();

 /** Lookup an operator by its mangled name, as used within the AST. */
 /** Lookup an operator by its mangled name (ex: _&&_), as used within the AST. */
 public static Optional<Operator> findReverse(String op) {
 return Optional.ofNullable(REVERSE_OPERATORS.get(op));
 }
Expand Down

4 changes: 4 additions & 0 deletions
policy/src/main/java/dev/cel/policy/BUILD.bazel

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,6 +215,8 @@ java_library(
 "//optimizer",
 "//optimizer:optimization_exception",
 "//optimizer:optimizer_builder",
 "//optimizer/optimizers:common_subexpression_elimination",
 "//optimizer/optimizers:constant_folding",
 "//validator",
 "//validator:ast_validator",
 "//validator:validator_builder",
Expand DownExpand Up@@ -247,7 +249,9 @@ java_library(
 "//common:cel_ast",
 "//common:compiler_common",
 "//common:mutable_ast",
 "//common/ast",
 "//common/formats:value_string",
 "//common/navigation:mutable_navigation",
 "//extensions:optional_library",
 "//optimizer:ast_optimizer",
 "//optimizer:mutable_ast",
Expand Down

29 changes: 27 additions & 2 deletions
policy/src/main/java/dev/cel/policy/CelPolicyCompilerImpl.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -36,6 +36,9 @@
import dev.cel.optimizer.CelOptimizationException;
import dev.cel.optimizer.CelOptimizer;
import dev.cel.optimizer.CelOptimizerFactory;
import dev.cel.optimizer.optimizers.ConstantFoldingOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer.SubexpressionOptimizerOptions;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result.Kind;
Expand DownExpand Up@@ -98,7 +101,7 @@ public CelCompiledRule compileRule(CelPolicy policy) throws CelPolicyValidationE
 public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledRule)
 throws CelPolicyValidationException {
 Cel cel = compiledRule.cel();
 CelOptimizer optimizer =
 CelOptimizer composingOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 RuleComposer.newInstance(compiledRule, variablesPrefix, iterationLimit))
Expand All@@ -110,7 +113,7 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 // This is a minimal expression used as a basis of stitching together all the rules into a
 // single graph.
 ast = cel.compile("true").getAst();
 ast = optimizer.optimize(ast);
 ast = composingOptimizer.optimize(ast);
 } catch (CelValidationException | CelOptimizationException e) {
 if (e.getCause() instanceof RuleCompositionException) {
 RuleCompositionException re = (RuleCompositionException) e.getCause();
Expand All@@ -136,6 +139,28 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 throw new CelPolicyValidationException("Unexpected error while composing rules.", e);
 }

 CelOptimizer astOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 ConstantFoldingOptimizer.getInstance(),
 SubexpressionOptimizer.newInstance(
 SubexpressionOptimizerOptions.newBuilder()
 // "record" is used for recording subexpression results via
 // BlueprintLateFunctionBinding. Safely eliminable, since repeated
 // invocation does not change the intermediate results.
 .addEliminableFunctions("record")
 .populateMacroCalls(true)
 .enableCelBlock(true)
 .build()))
 .build();
 try {
 // Optimize the composed graph using const fold and CSE
 ast = astOptimizer.optimize(ast);
 } catch (CelOptimizationException e) {
 throw new CelPolicyValidationException(
 "Failed to optimize the composed policy. Reason: " + e.getMessage(), e);
 }

 assertAstDepthIsSafe(ast, cel);

 return ast;
Expand Down

40 changes: 29 additions & 11 deletions
policy/src/main/java/dev/cel/policy/RuleComposer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,12 +19,16 @@
import static java.util.stream.Collectors.toCollection;

import com.google.auto.value.AutoValue;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Lists;
import dev.cel.bundle.Cel;
import dev.cel.common.CelAbstractSyntaxTree;
import dev.cel.common.CelMutableAst;
import dev.cel.common.CelValidationException;
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.formats.ValueString;
import dev.cel.common.navigation.CelNavigableMutableAst;
import dev.cel.common.navigation.CelNavigableMutableExpr;
import dev.cel.extensions.CelOptionalLibrary.Function;
import dev.cel.optimizer.AstMutator;
import dev.cel.optimizer.CelAstOptimizer;
Expand DownExpand Up@@ -151,23 +155,37 @@ private RuleOptimizationResult optimizeRule(Cel cel, CelCompiledRule compiledRul
 }
 }

 CelMutableAst result = matchAst;
 for (CelCompiledVariable variable : Lists.reverse(compiledRule.variables())) {
 result =
 astMutator.replaceSubtreeWithNewBindMacro(
 result,
 variablePrefix + variable.name(),
 CelMutableAst.fromCelAst(variable.ast()),
 result.expr(),
 result.expr().id(),
 true);
 }
 CelMutableAst result = inlineCompiledVariables(matchAst, compiledRule.variables());

 result = astMutator.renumberIdsConsecutively(result);

 return RuleOptimizationResult.create(result, isOptionalResult);
 }

 private CelMutableAst inlineCompiledVariables(
 CelMutableAst ast, List<CelCompiledVariable> compiledVariables) {
 CelMutableAst mutatedAst = ast;
 for (CelCompiledVariable compiledVariable : Lists.reverse(compiledVariables)) {
 String variableName = variablePrefix + compiledVariable.name();
 ImmutableList<CelNavigableMutableExpr> exprsToReplace =
 CelNavigableMutableAst.fromAst(mutatedAst)
 .getRoot()
 .allNodes()
 .filter(
 node ->
 node.expr().getKind().equals(Kind.IDENT)
 && node.expr().ident().name().equals(variableName))
 .collect(toImmutableList());

 for (CelNavigableMutableExpr expr : exprsToReplace) {
 CelMutableAst variableAst = CelMutableAst.fromCelAst(compiledVariable.ast());
 mutatedAst = astMutator.replaceSubtree(mutatedAst, variableAst, expr.id());
 }
 }

 return mutatedAst;
 }

 static RuleComposer newInstance(
 CelCompiledRule compiledRule, String variablePrefix, int iterationLimit) {
 return new RuleComposer(compiledRule, variablePrefix, iterationLimit);
Expand Down

32 changes: 28 additions & 4 deletions
policy/src/test/java/dev/cel/policy/CelPolicyCompilerImplTest.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,8 +136,8 @@ public void compileYamlPolicy_multilineContainsError_throws(

 @Test
 public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Exception {
String longExpr =
 "0+1+2+3+4+5+6+7+8+9+10+11+12+13+14+15+16+17+18+19+20+21+22+23+24+25+26+27+28+29+30+31+32+33+34+35+36+37+38+39+40+41+42+43+44+45+46+47+48+49+50";
Cel cel = newCel().toCelBuilder().addVar("msg", SimpleType.DYN).build();
String longExpr = "msg.b.c.d.e.f";
 String policyContent =
 String.format(
 "name: deeply_nested_ast\n" + "rule:\n" + " match:\n" + " - output: %s", longExpr);
Expand All@@ -146,11 +146,35 @@ public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Except
 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 () ->
 CelPolicyCompilerFactory.newPolicyCompiler(cel)
 .setAstDepthLimit(5)
 .build()
 .compile(policy));

 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 5.");
 }

 @Test
 public void compileYamlPolicy_constantFoldingFailure_throwsDuringComposition() throws Exception {
 String policyContent =
 "name: ast_with_div_by_zero\n" //
 + "rule:\n" //
 + " match:\n" //
 + " - output: 1 / 0";
 CelPolicy policy = POLICY_PARSER.parse(policyContent);

 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 50.");
 .isEqualTo(
 "Failed to optimize the composed policy. Reason: Constant folding failure. Failed to"
 + " evaluate subtree due to: evaluation error: / by zero");
 }

 @Test
Expand Down

100 changes: 40 additions & 60 deletions
policy/src/test/java/dev/cel/policy/PolicyTestHelper.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,88 +41,68 @@ enum TestYamlPolicy {
 NESTED_RULE(
 "nested_rule",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && "
 + "!(resource.origin in variables.permitted_regions)) "
 + "? optional.of({\"banned\": true}) : optional.none()).or("
 + "optional.of((resource.origin in variables.permitted_regions)"
 + " ? {\"banned\": false} : {\"banned\": true})))"),
 "cel.@block([resource.origin, @index0 in [\"us\", \"uk\", \"es\"], {\"banned\": true}],"
 + " ((@index0 in {\"us\": false, \"ru\": false, \"ir\": false} && !@index1) ?"
 + " optional.of(@index2) : optional.none()).or(optional.of(@index1 ? {\"banned\":"
 + " false} : @index2)))"),
 NESTED_RULE2(
 "nested_rule2",
 false,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && !(resource.origin in"
 + " variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} : {\"banned\":"
 + " \"bad_actor\"}) : (!(resource.origin in variables.permitted_regions) ? {\"banned\":"
 + " \"unconfigured_region\"} : {}))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? ((@index0 in {\"us\": false,"
 + " \"ru\": false, \"ir\": false} && @index1) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"}) : (@index1 ? {\"banned\": \"unconfigured_region\"} :"
 + " {}))"),
 NESTED_RULE3(
 "nested_rule3",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " optional.of(cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false,"
 + " \"ir\": false}, (resource.origin in variables.banned_regions && !(resource.origin"
 + " in variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"})) : (!(resource.origin in variables.permitted_regions)"
 + " ? optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? optional.of((@index0 in {\"us\":"
 + " false, \"ru\": false, \"ir\": false} && @index1) ? {\"banned\":"
 + " \"restricted_region\"} : {\"banned\": \"bad_actor\"}) : (@index1 ?"
 + " optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 REQUIRED_LABELS(
 "required_labels",
 true,
 ""
 + "cel.bind(variables.want, spec.labels, cel.bind(variables.missing, "
 + "variables.want.filter(l, !(l in resource.labels)), cel.bind(variables.invalid, "
 + "resource.labels.filter(l, l in variables.want && variables.want[l] != "
 + "resource.labels[l]), (variables.missing.size() > 0) ? "
 + "optional.of(\"missing one or more required labels: [\"\" + "
 + "variables.missing.join(\",\") + \"\"]\") : ((variables.invalid.size() > 0) ? "
 + "optional.of(\"invalid values provided on one or more labels: [\"\" + "
 + "variables.invalid.join(\",\") + \"\"]\") : optional.none()))))"),
 "cel.@block([spec.labels.filter(@it:0:0, !(@it:0:0 in resource.labels)), spec.labels,"
 + " resource.labels, @index2.filter(@it:0:0, @it:0:0 in @index1 && @index1[@it:0:0] !="
 + " @index2[@it:0:0])], (@index0.size() > 0) ? optional.of(\"missing one or more"
 + " required labels: [\"\" + @index0.join(\",\") + \"\"]\") : ((@index3.size() > 0) ?"
 + " optional.of(\"invalid values provided on one or more labels: [\"\" +"
 + " @index3.join(\",\") + \"\"]\") : optional.none()))"),
 RESTRICTED_DESTINATIONS(
 "restricted_destinations",
 false,
 "cel.bind(variables.matches_origin_ip, locationCode(origin.ip) == spec.origin,"
 + " cel.bind(variables.has_nationality, has(request.auth.claims.nationality),"
 + " cel.bind(variables.matches_nationality, variables.has_nationality &&"
 + " request.auth.claims.nationality == spec.origin, cel.bind(variables.matches_dest_ip,"
 + " locationCode(destination.ip) in spec.restricted_destinations,"
 + " cel.bind(variables.matches_dest_label, resource.labels.location in"
 + " spec.restricted_destinations, cel.bind(variables.matches_dest,"
 + " variables.matches_dest_ip || variables.matches_dest_label,"
 + " (variables.matches_nationality && variables.matches_dest) ? true :"
 + " ((!variables.has_nationality && variables.matches_origin_ip &&"
 + " variables.matches_dest) ? true : false)))))))"),
 "cel.@block([request.auth.claims, has(@index0.nationality), resource.labels.location in"
 + " spec.restricted_destinations], (@index1 && @index0.nationality == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " ((!@index1 && locationCode(origin.ip) == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " false))"),
 K8S(
 "k8s",
 true,
 "cel.bind(variables.env, resource.labels.?environment.orValue(\"prod\"),"
 + " cel.bind(variables.break_glass, resource.labels.?break_glass.orValue(\"false\") =="
 + " \"true\", !(variables.break_glass || resource.containers.all(c,"
 + " c.startsWith(variables.env + \".\"))) ? optional.of(\"only \" + variables.env + \""
 + " containers are allowed in namespace \" + resource.namespace) :"
 + " optional.none()))"),
 "cel.@block([resource.labels.?environment.orValue(\"prod\")],"
 + " !(resource.labels.?break_glass.orValue(\"false\") == \"true\" ||"
 + " resource.containers.all(@it:0:0, @it:0:0.startsWith(@index0 + \".\"))) ?"
 + " optional.of(\"only \" + @index0 + \" containers are allowed in namespace \" +"
 + " resource.namespace) : optional.none())"),
 PB(
 "pb",
 true,
 "(spec.single_int32 > TestAllTypes{single_int64: 10}.single_int64) ? optional.of(\"invalid"
 + " spec, got single_int32=\" + string(spec.single_int32) + \", wanted <= 10\") :"
 + " ((spec.standalone_enum == cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR"
 + " || dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 "cel.@block([spec.single_int32], (@index0 > 10) ? optional.of(\"invalid spec, got"
 + " single_int32=\" + string(@index0) + \", wanted <= 10\") : ((spec.standalone_enum =="
 + " cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR ||"
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGOO) ? optional.of(\"invalid"
 + " spec, neither nested nor imported enums may refer to BAR\") :"
 + " optional.none())"),
 + " spec, neither nested nor imported enums may refer to BAR\") : optional.none()))"),
 LIMITS(
 "limits",
 true,
 "cel.bind(variables.greeting, \"hello\", cel.bind(variables.farewell, \"goodbye\","
 + " cel.bind(variables.person, \"me\", cel.bind(variables.message_fmt, \"%s, %s\","
 + " (now.getHours() >= 20) ? cel.bind(variables.message, variables.farewell + \", \" +"
 + " variables.person, (now.getHours() < 21) ? optional.of(variables.message + \"!\") :"
 + " ((now.getHours() < 22) ? optional.of(variables.message + \"!!\") : ((now.getHours()"
 + " < 24) ? optional.of(variables.message + \"!!!\") : optional.none()))) :"
 + " optional.of(variables.greeting + \", \" + variables.person)))))");
 "cel.@block([now.getHours()], (@index0 >= 20) ? ((@index0 < 21) ? optional.of(\"goodbye,"
 + " me!\") : ((@index0 < 22) ? optional.of(\"goodbye, me!!\") : ((@index0 < 24) ?"
 + " optional.of(\"goodbye, me!!!\") : optional.none()))) : optional.of(\"hello,"
 + " me\"))");

 private final String name;
 private final boolean producesOptionalResult;
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Optimize composed policies using Constant Folding and Common Subexpression Elimination#793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

copybara-service
merged 1 commit into

from

Sep 2, 2025
 Merged


Optimize composed policies using Constant Folding and Common Subexpression Elimination
#793
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 6 additions & 1 deletion
optimizer/src/main/java/dev/cel/optimizer/optimizers/ConstantFoldingOptimizer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,7 @@
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.ast.CelMutableExpr;
import dev.cel.common.ast.CelMutableExpr.CelMutableCall;
import dev.cel.common.ast.CelMutableExpr.CelMutableComprehension;
import dev.cel.common.ast.CelMutableExpr.CelMutableList;
import dev.cel.common.ast.CelMutableExpr.CelMutableMap;
import dev.cel.common.ast.CelMutableExpr.CelMutableStruct;
Expand DownExpand Up@@ -202,7 +203,11 @@ private static boolean canFoldInOperator(CelNavigableMutableExpr navigableExpr)
 CelNavigableMutableExpr parent = identNode.parent().orElse(null);
 while (parent != null) {
 if (parent.getKind().equals(Kind.COMPREHENSION)) {
 if (parent.expr().comprehension().accuVar().equals(identNode.expr().ident().name())) {
 String identName = identNode.expr().ident().name();
 CelMutableComprehension parentComprehension = parent.expr().comprehension();
 if (parentComprehension.accuVar().equals(identName)
 || parentComprehension.iterVar().equals(identName)
 || parentComprehension.iterVar2().equals(identName)) {
 // Prevent folding a subexpression if it contains a variable declared by a
 // comprehension. The subexpression cannot be compiled without the full context of the
 // surrounding comprehension.
Expand Down

2 changes: 1 addition & 1 deletion
parser/src/main/java/dev/cel/parser/Operator.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -180,7 +180,7 @@ static Optional<Operator> find(String text) {
 .put(MODULO.getFunction(), "%")
 .buildOrThrow();

 /** Lookup an operator by its mangled name, as used within the AST. */
 /** Lookup an operator by its mangled name (ex: _&&_), as used within the AST. */
 public static Optional<Operator> findReverse(String op) {
 return Optional.ofNullable(REVERSE_OPERATORS.get(op));
 }
Expand Down

4 changes: 4 additions & 0 deletions
policy/src/main/java/dev/cel/policy/BUILD.bazel

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,6 +215,8 @@ java_library(
 "//optimizer",
 "//optimizer:optimization_exception",
 "//optimizer:optimizer_builder",
 "//optimizer/optimizers:common_subexpression_elimination",
 "//optimizer/optimizers:constant_folding",
 "//validator",
 "//validator:ast_validator",
 "//validator:validator_builder",
Expand DownExpand Up@@ -247,7 +249,9 @@ java_library(
 "//common:cel_ast",
 "//common:compiler_common",
 "//common:mutable_ast",
 "//common/ast",
 "//common/formats:value_string",
 "//common/navigation:mutable_navigation",
 "//extensions:optional_library",
 "//optimizer:ast_optimizer",
 "//optimizer:mutable_ast",
Expand Down

29 changes: 27 additions & 2 deletions
policy/src/main/java/dev/cel/policy/CelPolicyCompilerImpl.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -36,6 +36,9 @@
import dev.cel.optimizer.CelOptimizationException;
import dev.cel.optimizer.CelOptimizer;
import dev.cel.optimizer.CelOptimizerFactory;
import dev.cel.optimizer.optimizers.ConstantFoldingOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer.SubexpressionOptimizerOptions;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result.Kind;
Expand DownExpand Up@@ -98,7 +101,7 @@ public CelCompiledRule compileRule(CelPolicy policy) throws CelPolicyValidationE
 public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledRule)
 throws CelPolicyValidationException {
 Cel cel = compiledRule.cel();
 CelOptimizer optimizer =
 CelOptimizer composingOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 RuleComposer.newInstance(compiledRule, variablesPrefix, iterationLimit))
Expand All@@ -110,7 +113,7 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 // This is a minimal expression used as a basis of stitching together all the rules into a
 // single graph.
 ast = cel.compile("true").getAst();
 ast = optimizer.optimize(ast);
 ast = composingOptimizer.optimize(ast);
 } catch (CelValidationException | CelOptimizationException e) {
 if (e.getCause() instanceof RuleCompositionException) {
 RuleCompositionException re = (RuleCompositionException) e.getCause();
Expand All@@ -136,6 +139,28 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 throw new CelPolicyValidationException("Unexpected error while composing rules.", e);
 }

 CelOptimizer astOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 ConstantFoldingOptimizer.getInstance(),
 SubexpressionOptimizer.newInstance(
 SubexpressionOptimizerOptions.newBuilder()
 // "record" is used for recording subexpression results via
 // BlueprintLateFunctionBinding. Safely eliminable, since repeated
 // invocation does not change the intermediate results.
 .addEliminableFunctions("record")
 .populateMacroCalls(true)
 .enableCelBlock(true)
 .build()))
 .build();
 try {
 // Optimize the composed graph using const fold and CSE
 ast = astOptimizer.optimize(ast);
 } catch (CelOptimizationException e) {
 throw new CelPolicyValidationException(
 "Failed to optimize the composed policy. Reason: " + e.getMessage(), e);
 }

 assertAstDepthIsSafe(ast, cel);

 return ast;
Expand Down

40 changes: 29 additions & 11 deletions
policy/src/main/java/dev/cel/policy/RuleComposer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,12 +19,16 @@
import static java.util.stream.Collectors.toCollection;

import com.google.auto.value.AutoValue;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Lists;
import dev.cel.bundle.Cel;
import dev.cel.common.CelAbstractSyntaxTree;
import dev.cel.common.CelMutableAst;
import dev.cel.common.CelValidationException;
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.formats.ValueString;
import dev.cel.common.navigation.CelNavigableMutableAst;
import dev.cel.common.navigation.CelNavigableMutableExpr;
import dev.cel.extensions.CelOptionalLibrary.Function;
import dev.cel.optimizer.AstMutator;
import dev.cel.optimizer.CelAstOptimizer;
Expand DownExpand Up@@ -151,23 +155,37 @@ private RuleOptimizationResult optimizeRule(Cel cel, CelCompiledRule compiledRul
 }
 }

 CelMutableAst result = matchAst;
 for (CelCompiledVariable variable : Lists.reverse(compiledRule.variables())) {
 result =
 astMutator.replaceSubtreeWithNewBindMacro(
 result,
 variablePrefix + variable.name(),
 CelMutableAst.fromCelAst(variable.ast()),
 result.expr(),
 result.expr().id(),
 true);
 }
 CelMutableAst result = inlineCompiledVariables(matchAst, compiledRule.variables());

 result = astMutator.renumberIdsConsecutively(result);

 return RuleOptimizationResult.create(result, isOptionalResult);
 }

 private CelMutableAst inlineCompiledVariables(
 CelMutableAst ast, List<CelCompiledVariable> compiledVariables) {
 CelMutableAst mutatedAst = ast;
 for (CelCompiledVariable compiledVariable : Lists.reverse(compiledVariables)) {
 String variableName = variablePrefix + compiledVariable.name();
 ImmutableList<CelNavigableMutableExpr> exprsToReplace =
 CelNavigableMutableAst.fromAst(mutatedAst)
 .getRoot()
 .allNodes()
 .filter(
 node ->
 node.expr().getKind().equals(Kind.IDENT)
 && node.expr().ident().name().equals(variableName))
 .collect(toImmutableList());

 for (CelNavigableMutableExpr expr : exprsToReplace) {
 CelMutableAst variableAst = CelMutableAst.fromCelAst(compiledVariable.ast());
 mutatedAst = astMutator.replaceSubtree(mutatedAst, variableAst, expr.id());
 }
 }

 return mutatedAst;
 }

 static RuleComposer newInstance(
 CelCompiledRule compiledRule, String variablePrefix, int iterationLimit) {
 return new RuleComposer(compiledRule, variablePrefix, iterationLimit);
Expand Down

32 changes: 28 additions & 4 deletions
policy/src/test/java/dev/cel/policy/CelPolicyCompilerImplTest.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,8 +136,8 @@ public void compileYamlPolicy_multilineContainsError_throws(

 @Test
 public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Exception {
String longExpr =
 "0+1+2+3+4+5+6+7+8+9+10+11+12+13+14+15+16+17+18+19+20+21+22+23+24+25+26+27+28+29+30+31+32+33+34+35+36+37+38+39+40+41+42+43+44+45+46+47+48+49+50";
Cel cel = newCel().toCelBuilder().addVar("msg", SimpleType.DYN).build();
String longExpr = "msg.b.c.d.e.f";
 String policyContent =
 String.format(
 "name: deeply_nested_ast\n" + "rule:\n" + " match:\n" + " - output: %s", longExpr);
Expand All@@ -146,11 +146,35 @@ public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Except
 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 () ->
 CelPolicyCompilerFactory.newPolicyCompiler(cel)
 .setAstDepthLimit(5)
 .build()
 .compile(policy));

 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 5.");
 }

 @Test
 public void compileYamlPolicy_constantFoldingFailure_throwsDuringComposition() throws Exception {
 String policyContent =
 "name: ast_with_div_by_zero\n" //
 + "rule:\n" //
 + " match:\n" //
 + " - output: 1 / 0";
 CelPolicy policy = POLICY_PARSER.parse(policyContent);

 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 50.");
 .isEqualTo(
 "Failed to optimize the composed policy. Reason: Constant folding failure. Failed to"
 + " evaluate subtree due to: evaluation error: / by zero");
 }

 @Test
Expand Down

100 changes: 40 additions & 60 deletions
policy/src/test/java/dev/cel/policy/PolicyTestHelper.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,88 +41,68 @@ enum TestYamlPolicy {
 NESTED_RULE(
 "nested_rule",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && "
 + "!(resource.origin in variables.permitted_regions)) "
 + "? optional.of({\"banned\": true}) : optional.none()).or("
 + "optional.of((resource.origin in variables.permitted_regions)"
 + " ? {\"banned\": false} : {\"banned\": true})))"),
 "cel.@block([resource.origin, @index0 in [\"us\", \"uk\", \"es\"], {\"banned\": true}],"
 + " ((@index0 in {\"us\": false, \"ru\": false, \"ir\": false} && !@index1) ?"
 + " optional.of(@index2) : optional.none()).or(optional.of(@index1 ? {\"banned\":"
 + " false} : @index2)))"),
 NESTED_RULE2(
 "nested_rule2",
 false,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && !(resource.origin in"
 + " variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} : {\"banned\":"
 + " \"bad_actor\"}) : (!(resource.origin in variables.permitted_regions) ? {\"banned\":"
 + " \"unconfigured_region\"} : {}))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? ((@index0 in {\"us\": false,"
 + " \"ru\": false, \"ir\": false} && @index1) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"}) : (@index1 ? {\"banned\": \"unconfigured_region\"} :"
 + " {}))"),
 NESTED_RULE3(
 "nested_rule3",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " optional.of(cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false,"
 + " \"ir\": false}, (resource.origin in variables.banned_regions && !(resource.origin"
 + " in variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"})) : (!(resource.origin in variables.permitted_regions)"
 + " ? optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? optional.of((@index0 in {\"us\":"
 + " false, \"ru\": false, \"ir\": false} && @index1) ? {\"banned\":"
 + " \"restricted_region\"} : {\"banned\": \"bad_actor\"}) : (@index1 ?"
 + " optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 REQUIRED_LABELS(
 "required_labels",
 true,
 ""
 + "cel.bind(variables.want, spec.labels, cel.bind(variables.missing, "
 + "variables.want.filter(l, !(l in resource.labels)), cel.bind(variables.invalid, "
 + "resource.labels.filter(l, l in variables.want && variables.want[l] != "
 + "resource.labels[l]), (variables.missing.size() > 0) ? "
 + "optional.of(\"missing one or more required labels: [\"\" + "
 + "variables.missing.join(\",\") + \"\"]\") : ((variables.invalid.size() > 0) ? "
 + "optional.of(\"invalid values provided on one or more labels: [\"\" + "
 + "variables.invalid.join(\",\") + \"\"]\") : optional.none()))))"),
 "cel.@block([spec.labels.filter(@it:0:0, !(@it:0:0 in resource.labels)), spec.labels,"
 + " resource.labels, @index2.filter(@it:0:0, @it:0:0 in @index1 && @index1[@it:0:0] !="
 + " @index2[@it:0:0])], (@index0.size() > 0) ? optional.of(\"missing one or more"
 + " required labels: [\"\" + @index0.join(\",\") + \"\"]\") : ((@index3.size() > 0) ?"
 + " optional.of(\"invalid values provided on one or more labels: [\"\" +"
 + " @index3.join(\",\") + \"\"]\") : optional.none()))"),
 RESTRICTED_DESTINATIONS(
 "restricted_destinations",
 false,
 "cel.bind(variables.matches_origin_ip, locationCode(origin.ip) == spec.origin,"
 + " cel.bind(variables.has_nationality, has(request.auth.claims.nationality),"
 + " cel.bind(variables.matches_nationality, variables.has_nationality &&"
 + " request.auth.claims.nationality == spec.origin, cel.bind(variables.matches_dest_ip,"
 + " locationCode(destination.ip) in spec.restricted_destinations,"
 + " cel.bind(variables.matches_dest_label, resource.labels.location in"
 + " spec.restricted_destinations, cel.bind(variables.matches_dest,"
 + " variables.matches_dest_ip || variables.matches_dest_label,"
 + " (variables.matches_nationality && variables.matches_dest) ? true :"
 + " ((!variables.has_nationality && variables.matches_origin_ip &&"
 + " variables.matches_dest) ? true : false)))))))"),
 "cel.@block([request.auth.claims, has(@index0.nationality), resource.labels.location in"
 + " spec.restricted_destinations], (@index1 && @index0.nationality == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " ((!@index1 && locationCode(origin.ip) == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " false))"),
 K8S(
 "k8s",
 true,
 "cel.bind(variables.env, resource.labels.?environment.orValue(\"prod\"),"
 + " cel.bind(variables.break_glass, resource.labels.?break_glass.orValue(\"false\") =="
 + " \"true\", !(variables.break_glass || resource.containers.all(c,"
 + " c.startsWith(variables.env + \".\"))) ? optional.of(\"only \" + variables.env + \""
 + " containers are allowed in namespace \" + resource.namespace) :"
 + " optional.none()))"),
 "cel.@block([resource.labels.?environment.orValue(\"prod\")],"
 + " !(resource.labels.?break_glass.orValue(\"false\") == \"true\" ||"
 + " resource.containers.all(@it:0:0, @it:0:0.startsWith(@index0 + \".\"))) ?"
 + " optional.of(\"only \" + @index0 + \" containers are allowed in namespace \" +"
 + " resource.namespace) : optional.none())"),
 PB(
 "pb",
 true,
 "(spec.single_int32 > TestAllTypes{single_int64: 10}.single_int64) ? optional.of(\"invalid"
 + " spec, got single_int32=\" + string(spec.single_int32) + \", wanted <= 10\") :"
 + " ((spec.standalone_enum == cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR"
 + " || dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 "cel.@block([spec.single_int32], (@index0 > 10) ? optional.of(\"invalid spec, got"
 + " single_int32=\" + string(@index0) + \", wanted <= 10\") : ((spec.standalone_enum =="
 + " cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR ||"
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGOO) ? optional.of(\"invalid"
 + " spec, neither nested nor imported enums may refer to BAR\") :"
 + " optional.none())"),
 + " spec, neither nested nor imported enums may refer to BAR\") : optional.none()))"),
 LIMITS(
 "limits",
 true,
 "cel.bind(variables.greeting, \"hello\", cel.bind(variables.farewell, \"goodbye\","
 + " cel.bind(variables.person, \"me\", cel.bind(variables.message_fmt, \"%s, %s\","
 + " (now.getHours() >= 20) ? cel.bind(variables.message, variables.farewell + \", \" +"
 + " variables.person, (now.getHours() < 21) ? optional.of(variables.message + \"!\") :"
 + " ((now.getHours() < 22) ? optional.of(variables.message + \"!!\") : ((now.getHours()"
 + " < 24) ? optional.of(variables.message + \"!!!\") : optional.none()))) :"
 + " optional.of(variables.greeting + \", \" + variables.person)))))");
 "cel.@block([now.getHours()], (@index0 >= 20) ? ((@index0 < 21) ? optional.of(\"goodbye,"
 + " me!\") : ((@index0 < 22) ? optional.of(\"goodbye, me!!\") : ((@index0 < 24) ?"
 + " optional.of(\"goodbye, me!!!\") : optional.none()))) : optional.of(\"hello,"
 + " me\"))");

 private final String name;
 private final boolean producesOptionalResult;
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Optimize composed policies using Constant Folding and Common Subexpression Elimination#793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

copybara-service
merged 1 commit into

from

Sep 2, 2025
 Merged


Optimize composed policies using Constant Folding and Common Subexpression Elimination
#793
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 6 additions & 1 deletion
optimizer/src/main/java/dev/cel/optimizer/optimizers/ConstantFoldingOptimizer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,7 @@
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.ast.CelMutableExpr;
import dev.cel.common.ast.CelMutableExpr.CelMutableCall;
import dev.cel.common.ast.CelMutableExpr.CelMutableComprehension;
import dev.cel.common.ast.CelMutableExpr.CelMutableList;
import dev.cel.common.ast.CelMutableExpr.CelMutableMap;
import dev.cel.common.ast.CelMutableExpr.CelMutableStruct;
Expand DownExpand Up@@ -202,7 +203,11 @@ private static boolean canFoldInOperator(CelNavigableMutableExpr navigableExpr)
 CelNavigableMutableExpr parent = identNode.parent().orElse(null);
 while (parent != null) {
 if (parent.getKind().equals(Kind.COMPREHENSION)) {
 if (parent.expr().comprehension().accuVar().equals(identNode.expr().ident().name())) {
 String identName = identNode.expr().ident().name();
 CelMutableComprehension parentComprehension = parent.expr().comprehension();
 if (parentComprehension.accuVar().equals(identName)
 || parentComprehension.iterVar().equals(identName)
 || parentComprehension.iterVar2().equals(identName)) {
 // Prevent folding a subexpression if it contains a variable declared by a
 // comprehension. The subexpression cannot be compiled without the full context of the
 // surrounding comprehension.
Expand Down

2 changes: 1 addition & 1 deletion
parser/src/main/java/dev/cel/parser/Operator.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -180,7 +180,7 @@ static Optional<Operator> find(String text) {
 .put(MODULO.getFunction(), "%")
 .buildOrThrow();

 /** Lookup an operator by its mangled name, as used within the AST. */
 /** Lookup an operator by its mangled name (ex: _&&_), as used within the AST. */
 public static Optional<Operator> findReverse(String op) {
 return Optional.ofNullable(REVERSE_OPERATORS.get(op));
 }
Expand Down

4 changes: 4 additions & 0 deletions
policy/src/main/java/dev/cel/policy/BUILD.bazel

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,6 +215,8 @@ java_library(
 "//optimizer",
 "//optimizer:optimization_exception",
 "//optimizer:optimizer_builder",
 "//optimizer/optimizers:common_subexpression_elimination",
 "//optimizer/optimizers:constant_folding",
 "//validator",
 "//validator:ast_validator",
 "//validator:validator_builder",
Expand DownExpand Up@@ -247,7 +249,9 @@ java_library(
 "//common:cel_ast",
 "//common:compiler_common",
 "//common:mutable_ast",
 "//common/ast",
 "//common/formats:value_string",
 "//common/navigation:mutable_navigation",
 "//extensions:optional_library",
 "//optimizer:ast_optimizer",
 "//optimizer:mutable_ast",
Expand Down

29 changes: 27 additions & 2 deletions
policy/src/main/java/dev/cel/policy/CelPolicyCompilerImpl.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -36,6 +36,9 @@
import dev.cel.optimizer.CelOptimizationException;
import dev.cel.optimizer.CelOptimizer;
import dev.cel.optimizer.CelOptimizerFactory;
import dev.cel.optimizer.optimizers.ConstantFoldingOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer.SubexpressionOptimizerOptions;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result.Kind;
Expand DownExpand Up@@ -98,7 +101,7 @@ public CelCompiledRule compileRule(CelPolicy policy) throws CelPolicyValidationE
 public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledRule)
 throws CelPolicyValidationException {
 Cel cel = compiledRule.cel();
 CelOptimizer optimizer =
 CelOptimizer composingOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 RuleComposer.newInstance(compiledRule, variablesPrefix, iterationLimit))
Expand All@@ -110,7 +113,7 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 // This is a minimal expression used as a basis of stitching together all the rules into a
 // single graph.
 ast = cel.compile("true").getAst();
 ast = optimizer.optimize(ast);
 ast = composingOptimizer.optimize(ast);
 } catch (CelValidationException | CelOptimizationException e) {
 if (e.getCause() instanceof RuleCompositionException) {
 RuleCompositionException re = (RuleCompositionException) e.getCause();
Expand All@@ -136,6 +139,28 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 throw new CelPolicyValidationException("Unexpected error while composing rules.", e);
 }

 CelOptimizer astOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 ConstantFoldingOptimizer.getInstance(),
 SubexpressionOptimizer.newInstance(
 SubexpressionOptimizerOptions.newBuilder()
 // "record" is used for recording subexpression results via
 // BlueprintLateFunctionBinding. Safely eliminable, since repeated
 // invocation does not change the intermediate results.
 .addEliminableFunctions("record")
 .populateMacroCalls(true)
 .enableCelBlock(true)
 .build()))
 .build();
 try {
 // Optimize the composed graph using const fold and CSE
 ast = astOptimizer.optimize(ast);
 } catch (CelOptimizationException e) {
 throw new CelPolicyValidationException(
 "Failed to optimize the composed policy. Reason: " + e.getMessage(), e);
 }

 assertAstDepthIsSafe(ast, cel);

 return ast;
Expand Down

40 changes: 29 additions & 11 deletions
policy/src/main/java/dev/cel/policy/RuleComposer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,12 +19,16 @@
import static java.util.stream.Collectors.toCollection;

import com.google.auto.value.AutoValue;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Lists;
import dev.cel.bundle.Cel;
import dev.cel.common.CelAbstractSyntaxTree;
import dev.cel.common.CelMutableAst;
import dev.cel.common.CelValidationException;
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.formats.ValueString;
import dev.cel.common.navigation.CelNavigableMutableAst;
import dev.cel.common.navigation.CelNavigableMutableExpr;
import dev.cel.extensions.CelOptionalLibrary.Function;
import dev.cel.optimizer.AstMutator;
import dev.cel.optimizer.CelAstOptimizer;
Expand DownExpand Up@@ -151,23 +155,37 @@ private RuleOptimizationResult optimizeRule(Cel cel, CelCompiledRule compiledRul
 }
 }

 CelMutableAst result = matchAst;
 for (CelCompiledVariable variable : Lists.reverse(compiledRule.variables())) {
 result =
 astMutator.replaceSubtreeWithNewBindMacro(
 result,
 variablePrefix + variable.name(),
 CelMutableAst.fromCelAst(variable.ast()),
 result.expr(),
 result.expr().id(),
 true);
 }
 CelMutableAst result = inlineCompiledVariables(matchAst, compiledRule.variables());

 result = astMutator.renumberIdsConsecutively(result);

 return RuleOptimizationResult.create(result, isOptionalResult);
 }

 private CelMutableAst inlineCompiledVariables(
 CelMutableAst ast, List<CelCompiledVariable> compiledVariables) {
 CelMutableAst mutatedAst = ast;
 for (CelCompiledVariable compiledVariable : Lists.reverse(compiledVariables)) {
 String variableName = variablePrefix + compiledVariable.name();
 ImmutableList<CelNavigableMutableExpr> exprsToReplace =
 CelNavigableMutableAst.fromAst(mutatedAst)
 .getRoot()
 .allNodes()
 .filter(
 node ->
 node.expr().getKind().equals(Kind.IDENT)
 && node.expr().ident().name().equals(variableName))
 .collect(toImmutableList());

 for (CelNavigableMutableExpr expr : exprsToReplace) {
 CelMutableAst variableAst = CelMutableAst.fromCelAst(compiledVariable.ast());
 mutatedAst = astMutator.replaceSubtree(mutatedAst, variableAst, expr.id());
 }
 }

 return mutatedAst;
 }

 static RuleComposer newInstance(
 CelCompiledRule compiledRule, String variablePrefix, int iterationLimit) {
 return new RuleComposer(compiledRule, variablePrefix, iterationLimit);
Expand Down

32 changes: 28 additions & 4 deletions
policy/src/test/java/dev/cel/policy/CelPolicyCompilerImplTest.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,8 +136,8 @@ public void compileYamlPolicy_multilineContainsError_throws(

 @Test
 public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Exception {
String longExpr =
 "0+1+2+3+4+5+6+7+8+9+10+11+12+13+14+15+16+17+18+19+20+21+22+23+24+25+26+27+28+29+30+31+32+33+34+35+36+37+38+39+40+41+42+43+44+45+46+47+48+49+50";
Cel cel = newCel().toCelBuilder().addVar("msg", SimpleType.DYN).build();
String longExpr = "msg.b.c.d.e.f";
 String policyContent =
 String.format(
 "name: deeply_nested_ast\n" + "rule:\n" + " match:\n" + " - output: %s", longExpr);
Expand All@@ -146,11 +146,35 @@ public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Except
 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 () ->
 CelPolicyCompilerFactory.newPolicyCompiler(cel)
 .setAstDepthLimit(5)
 .build()
 .compile(policy));

 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 5.");
 }

 @Test
 public void compileYamlPolicy_constantFoldingFailure_throwsDuringComposition() throws Exception {
 String policyContent =
 "name: ast_with_div_by_zero\n" //
 + "rule:\n" //
 + " match:\n" //
 + " - output: 1 / 0";
 CelPolicy policy = POLICY_PARSER.parse(policyContent);

 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 50.");
 .isEqualTo(
 "Failed to optimize the composed policy. Reason: Constant folding failure. Failed to"
 + " evaluate subtree due to: evaluation error: / by zero");
 }

 @Test
Expand Down

100 changes: 40 additions & 60 deletions
policy/src/test/java/dev/cel/policy/PolicyTestHelper.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,88 +41,68 @@ enum TestYamlPolicy {
 NESTED_RULE(
 "nested_rule",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && "
 + "!(resource.origin in variables.permitted_regions)) "
 + "? optional.of({\"banned\": true}) : optional.none()).or("
 + "optional.of((resource.origin in variables.permitted_regions)"
 + " ? {\"banned\": false} : {\"banned\": true})))"),
 "cel.@block([resource.origin, @index0 in [\"us\", \"uk\", \"es\"], {\"banned\": true}],"
 + " ((@index0 in {\"us\": false, \"ru\": false, \"ir\": false} && !@index1) ?"
 + " optional.of(@index2) : optional.none()).or(optional.of(@index1 ? {\"banned\":"
 + " false} : @index2)))"),
 NESTED_RULE2(
 "nested_rule2",
 false,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && !(resource.origin in"
 + " variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} : {\"banned\":"
 + " \"bad_actor\"}) : (!(resource.origin in variables.permitted_regions) ? {\"banned\":"
 + " \"unconfigured_region\"} : {}))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? ((@index0 in {\"us\": false,"
 + " \"ru\": false, \"ir\": false} && @index1) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"}) : (@index1 ? {\"banned\": \"unconfigured_region\"} :"
 + " {}))"),
 NESTED_RULE3(
 "nested_rule3",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " optional.of(cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false,"
 + " \"ir\": false}, (resource.origin in variables.banned_regions && !(resource.origin"
 + " in variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"})) : (!(resource.origin in variables.permitted_regions)"
 + " ? optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? optional.of((@index0 in {\"us\":"
 + " false, \"ru\": false, \"ir\": false} && @index1) ? {\"banned\":"
 + " \"restricted_region\"} : {\"banned\": \"bad_actor\"}) : (@index1 ?"
 + " optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 REQUIRED_LABELS(
 "required_labels",
 true,
 ""
 + "cel.bind(variables.want, spec.labels, cel.bind(variables.missing, "
 + "variables.want.filter(l, !(l in resource.labels)), cel.bind(variables.invalid, "
 + "resource.labels.filter(l, l in variables.want && variables.want[l] != "
 + "resource.labels[l]), (variables.missing.size() > 0) ? "
 + "optional.of(\"missing one or more required labels: [\"\" + "
 + "variables.missing.join(\",\") + \"\"]\") : ((variables.invalid.size() > 0) ? "
 + "optional.of(\"invalid values provided on one or more labels: [\"\" + "
 + "variables.invalid.join(\",\") + \"\"]\") : optional.none()))))"),
 "cel.@block([spec.labels.filter(@it:0:0, !(@it:0:0 in resource.labels)), spec.labels,"
 + " resource.labels, @index2.filter(@it:0:0, @it:0:0 in @index1 && @index1[@it:0:0] !="
 + " @index2[@it:0:0])], (@index0.size() > 0) ? optional.of(\"missing one or more"
 + " required labels: [\"\" + @index0.join(\",\") + \"\"]\") : ((@index3.size() > 0) ?"
 + " optional.of(\"invalid values provided on one or more labels: [\"\" +"
 + " @index3.join(\",\") + \"\"]\") : optional.none()))"),
 RESTRICTED_DESTINATIONS(
 "restricted_destinations",
 false,
 "cel.bind(variables.matches_origin_ip, locationCode(origin.ip) == spec.origin,"
 + " cel.bind(variables.has_nationality, has(request.auth.claims.nationality),"
 + " cel.bind(variables.matches_nationality, variables.has_nationality &&"
 + " request.auth.claims.nationality == spec.origin, cel.bind(variables.matches_dest_ip,"
 + " locationCode(destination.ip) in spec.restricted_destinations,"
 + " cel.bind(variables.matches_dest_label, resource.labels.location in"
 + " spec.restricted_destinations, cel.bind(variables.matches_dest,"
 + " variables.matches_dest_ip || variables.matches_dest_label,"
 + " (variables.matches_nationality && variables.matches_dest) ? true :"
 + " ((!variables.has_nationality && variables.matches_origin_ip &&"
 + " variables.matches_dest) ? true : false)))))))"),
 "cel.@block([request.auth.claims, has(@index0.nationality), resource.labels.location in"
 + " spec.restricted_destinations], (@index1 && @index0.nationality == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " ((!@index1 && locationCode(origin.ip) == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " false))"),
 K8S(
 "k8s",
 true,
 "cel.bind(variables.env, resource.labels.?environment.orValue(\"prod\"),"
 + " cel.bind(variables.break_glass, resource.labels.?break_glass.orValue(\"false\") =="
 + " \"true\", !(variables.break_glass || resource.containers.all(c,"
 + " c.startsWith(variables.env + \".\"))) ? optional.of(\"only \" + variables.env + \""
 + " containers are allowed in namespace \" + resource.namespace) :"
 + " optional.none()))"),
 "cel.@block([resource.labels.?environment.orValue(\"prod\")],"
 + " !(resource.labels.?break_glass.orValue(\"false\") == \"true\" ||"
 + " resource.containers.all(@it:0:0, @it:0:0.startsWith(@index0 + \".\"))) ?"
 + " optional.of(\"only \" + @index0 + \" containers are allowed in namespace \" +"
 + " resource.namespace) : optional.none())"),
 PB(
 "pb",
 true,
 "(spec.single_int32 > TestAllTypes{single_int64: 10}.single_int64) ? optional.of(\"invalid"
 + " spec, got single_int32=\" + string(spec.single_int32) + \", wanted <= 10\") :"
 + " ((spec.standalone_enum == cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR"
 + " || dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 "cel.@block([spec.single_int32], (@index0 > 10) ? optional.of(\"invalid spec, got"
 + " single_int32=\" + string(@index0) + \", wanted <= 10\") : ((spec.standalone_enum =="
 + " cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR ||"
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGOO) ? optional.of(\"invalid"
 + " spec, neither nested nor imported enums may refer to BAR\") :"
 + " optional.none())"),
 + " spec, neither nested nor imported enums may refer to BAR\") : optional.none()))"),
 LIMITS(
 "limits",
 true,
 "cel.bind(variables.greeting, \"hello\", cel.bind(variables.farewell, \"goodbye\","
 + " cel.bind(variables.person, \"me\", cel.bind(variables.message_fmt, \"%s, %s\","
 + " (now.getHours() >= 20) ? cel.bind(variables.message, variables.farewell + \", \" +"
 + " variables.person, (now.getHours() < 21) ? optional.of(variables.message + \"!\") :"
 + " ((now.getHours() < 22) ? optional.of(variables.message + \"!!\") : ((now.getHours()"
 + " < 24) ? optional.of(variables.message + \"!!!\") : optional.none()))) :"
 + " optional.of(variables.greeting + \", \" + variables.person)))))");
 "cel.@block([now.getHours()], (@index0 >= 20) ? ((@index0 < 21) ? optional.of(\"goodbye,"
 + " me!\") : ((@index0 < 22) ? optional.of(\"goodbye, me!!\") : ((@index0 < 24) ?"
 + " optional.of(\"goodbye, me!!!\") : optional.none()))) : optional.of(\"hello,"
 + " me\"))");

 private final String name;
 private final boolean producesOptionalResult;
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Optimize composed policies using Constant Folding and Common Subexpression Elimination#793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

copybara-service
merged 1 commit into

from

Sep 2, 2025
 Merged


Optimize composed policies using Constant Folding and Common Subexpression Elimination
#793
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 6 additions & 1 deletion
optimizer/src/main/java/dev/cel/optimizer/optimizers/ConstantFoldingOptimizer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,7 @@
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.ast.CelMutableExpr;
import dev.cel.common.ast.CelMutableExpr.CelMutableCall;
import dev.cel.common.ast.CelMutableExpr.CelMutableComprehension;
import dev.cel.common.ast.CelMutableExpr.CelMutableList;
import dev.cel.common.ast.CelMutableExpr.CelMutableMap;
import dev.cel.common.ast.CelMutableExpr.CelMutableStruct;
Expand DownExpand Up@@ -202,7 +203,11 @@ private static boolean canFoldInOperator(CelNavigableMutableExpr navigableExpr)
 CelNavigableMutableExpr parent = identNode.parent().orElse(null);
 while (parent != null) {
 if (parent.getKind().equals(Kind.COMPREHENSION)) {
 if (parent.expr().comprehension().accuVar().equals(identNode.expr().ident().name())) {
 String identName = identNode.expr().ident().name();
 CelMutableComprehension parentComprehension = parent.expr().comprehension();
 if (parentComprehension.accuVar().equals(identName)
 || parentComprehension.iterVar().equals(identName)
 || parentComprehension.iterVar2().equals(identName)) {
 // Prevent folding a subexpression if it contains a variable declared by a
 // comprehension. The subexpression cannot be compiled without the full context of the
 // surrounding comprehension.
Expand Down

2 changes: 1 addition & 1 deletion
parser/src/main/java/dev/cel/parser/Operator.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -180,7 +180,7 @@ static Optional<Operator> find(String text) {
 .put(MODULO.getFunction(), "%")
 .buildOrThrow();

 /** Lookup an operator by its mangled name, as used within the AST. */
 /** Lookup an operator by its mangled name (ex: _&&_), as used within the AST. */
 public static Optional<Operator> findReverse(String op) {
 return Optional.ofNullable(REVERSE_OPERATORS.get(op));
 }
Expand Down

4 changes: 4 additions & 0 deletions
policy/src/main/java/dev/cel/policy/BUILD.bazel

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,6 +215,8 @@ java_library(
 "//optimizer",
 "//optimizer:optimization_exception",
 "//optimizer:optimizer_builder",
 "//optimizer/optimizers:common_subexpression_elimination",
 "//optimizer/optimizers:constant_folding",
 "//validator",
 "//validator:ast_validator",
 "//validator:validator_builder",
Expand DownExpand Up@@ -247,7 +249,9 @@ java_library(
 "//common:cel_ast",
 "//common:compiler_common",
 "//common:mutable_ast",
 "//common/ast",
 "//common/formats:value_string",
 "//common/navigation:mutable_navigation",
 "//extensions:optional_library",
 "//optimizer:ast_optimizer",
 "//optimizer:mutable_ast",
Expand Down

29 changes: 27 additions & 2 deletions
policy/src/main/java/dev/cel/policy/CelPolicyCompilerImpl.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -36,6 +36,9 @@
import dev.cel.optimizer.CelOptimizationException;
import dev.cel.optimizer.CelOptimizer;
import dev.cel.optimizer.CelOptimizerFactory;
import dev.cel.optimizer.optimizers.ConstantFoldingOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer.SubexpressionOptimizerOptions;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result.Kind;
Expand DownExpand Up@@ -98,7 +101,7 @@ public CelCompiledRule compileRule(CelPolicy policy) throws CelPolicyValidationE
 public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledRule)
 throws CelPolicyValidationException {
 Cel cel = compiledRule.cel();
 CelOptimizer optimizer =
 CelOptimizer composingOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 RuleComposer.newInstance(compiledRule, variablesPrefix, iterationLimit))
Expand All@@ -110,7 +113,7 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 // This is a minimal expression used as a basis of stitching together all the rules into a
 // single graph.
 ast = cel.compile("true").getAst();
 ast = optimizer.optimize(ast);
 ast = composingOptimizer.optimize(ast);
 } catch (CelValidationException | CelOptimizationException e) {
 if (e.getCause() instanceof RuleCompositionException) {
 RuleCompositionException re = (RuleCompositionException) e.getCause();
Expand All@@ -136,6 +139,28 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 throw new CelPolicyValidationException("Unexpected error while composing rules.", e);
 }

 CelOptimizer astOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 ConstantFoldingOptimizer.getInstance(),
 SubexpressionOptimizer.newInstance(
 SubexpressionOptimizerOptions.newBuilder()
 // "record" is used for recording subexpression results via
 // BlueprintLateFunctionBinding. Safely eliminable, since repeated
 // invocation does not change the intermediate results.
 .addEliminableFunctions("record")
 .populateMacroCalls(true)
 .enableCelBlock(true)
 .build()))
 .build();
 try {
 // Optimize the composed graph using const fold and CSE
 ast = astOptimizer.optimize(ast);
 } catch (CelOptimizationException e) {
 throw new CelPolicyValidationException(
 "Failed to optimize the composed policy. Reason: " + e.getMessage(), e);
 }

 assertAstDepthIsSafe(ast, cel);

 return ast;
Expand Down

40 changes: 29 additions & 11 deletions
policy/src/main/java/dev/cel/policy/RuleComposer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,12 +19,16 @@
import static java.util.stream.Collectors.toCollection;

import com.google.auto.value.AutoValue;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Lists;
import dev.cel.bundle.Cel;
import dev.cel.common.CelAbstractSyntaxTree;
import dev.cel.common.CelMutableAst;
import dev.cel.common.CelValidationException;
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.formats.ValueString;
import dev.cel.common.navigation.CelNavigableMutableAst;
import dev.cel.common.navigation.CelNavigableMutableExpr;
import dev.cel.extensions.CelOptionalLibrary.Function;
import dev.cel.optimizer.AstMutator;
import dev.cel.optimizer.CelAstOptimizer;
Expand DownExpand Up@@ -151,23 +155,37 @@ private RuleOptimizationResult optimizeRule(Cel cel, CelCompiledRule compiledRul
 }
 }

 CelMutableAst result = matchAst;
 for (CelCompiledVariable variable : Lists.reverse(compiledRule.variables())) {
 result =
 astMutator.replaceSubtreeWithNewBindMacro(
 result,
 variablePrefix + variable.name(),
 CelMutableAst.fromCelAst(variable.ast()),
 result.expr(),
 result.expr().id(),
 true);
 }
 CelMutableAst result = inlineCompiledVariables(matchAst, compiledRule.variables());

 result = astMutator.renumberIdsConsecutively(result);

 return RuleOptimizationResult.create(result, isOptionalResult);
 }

 private CelMutableAst inlineCompiledVariables(
 CelMutableAst ast, List<CelCompiledVariable> compiledVariables) {
 CelMutableAst mutatedAst = ast;
 for (CelCompiledVariable compiledVariable : Lists.reverse(compiledVariables)) {
 String variableName = variablePrefix + compiledVariable.name();
 ImmutableList<CelNavigableMutableExpr> exprsToReplace =
 CelNavigableMutableAst.fromAst(mutatedAst)
 .getRoot()
 .allNodes()
 .filter(
 node ->
 node.expr().getKind().equals(Kind.IDENT)
 && node.expr().ident().name().equals(variableName))
 .collect(toImmutableList());

 for (CelNavigableMutableExpr expr : exprsToReplace) {
 CelMutableAst variableAst = CelMutableAst.fromCelAst(compiledVariable.ast());
 mutatedAst = astMutator.replaceSubtree(mutatedAst, variableAst, expr.id());
 }
 }

 return mutatedAst;
 }

 static RuleComposer newInstance(
 CelCompiledRule compiledRule, String variablePrefix, int iterationLimit) {
 return new RuleComposer(compiledRule, variablePrefix, iterationLimit);
Expand Down

32 changes: 28 additions & 4 deletions
policy/src/test/java/dev/cel/policy/CelPolicyCompilerImplTest.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,8 +136,8 @@ public void compileYamlPolicy_multilineContainsError_throws(

 @Test
 public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Exception {
String longExpr =
 "0+1+2+3+4+5+6+7+8+9+10+11+12+13+14+15+16+17+18+19+20+21+22+23+24+25+26+27+28+29+30+31+32+33+34+35+36+37+38+39+40+41+42+43+44+45+46+47+48+49+50";
Cel cel = newCel().toCelBuilder().addVar("msg", SimpleType.DYN).build();
String longExpr = "msg.b.c.d.e.f";
 String policyContent =
 String.format(
 "name: deeply_nested_ast\n" + "rule:\n" + " match:\n" + " - output: %s", longExpr);
Expand All@@ -146,11 +146,35 @@ public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Except
 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 () ->
 CelPolicyCompilerFactory.newPolicyCompiler(cel)
 .setAstDepthLimit(5)
 .build()
 .compile(policy));

 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 5.");
 }

 @Test
 public void compileYamlPolicy_constantFoldingFailure_throwsDuringComposition() throws Exception {
 String policyContent =
 "name: ast_with_div_by_zero\n" //
 + "rule:\n" //
 + " match:\n" //
 + " - output: 1 / 0";
 CelPolicy policy = POLICY_PARSER.parse(policyContent);

 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 50.");
 .isEqualTo(
 "Failed to optimize the composed policy. Reason: Constant folding failure. Failed to"
 + " evaluate subtree due to: evaluation error: / by zero");
 }

 @Test
Expand Down

100 changes: 40 additions & 60 deletions
policy/src/test/java/dev/cel/policy/PolicyTestHelper.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,88 +41,68 @@ enum TestYamlPolicy {
 NESTED_RULE(
 "nested_rule",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && "
 + "!(resource.origin in variables.permitted_regions)) "
 + "? optional.of({\"banned\": true}) : optional.none()).or("
 + "optional.of((resource.origin in variables.permitted_regions)"
 + " ? {\"banned\": false} : {\"banned\": true})))"),
 "cel.@block([resource.origin, @index0 in [\"us\", \"uk\", \"es\"], {\"banned\": true}],"
 + " ((@index0 in {\"us\": false, \"ru\": false, \"ir\": false} && !@index1) ?"
 + " optional.of(@index2) : optional.none()).or(optional.of(@index1 ? {\"banned\":"
 + " false} : @index2)))"),
 NESTED_RULE2(
 "nested_rule2",
 false,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && !(resource.origin in"
 + " variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} : {\"banned\":"
 + " \"bad_actor\"}) : (!(resource.origin in variables.permitted_regions) ? {\"banned\":"
 + " \"unconfigured_region\"} : {}))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? ((@index0 in {\"us\": false,"
 + " \"ru\": false, \"ir\": false} && @index1) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"}) : (@index1 ? {\"banned\": \"unconfigured_region\"} :"
 + " {}))"),
 NESTED_RULE3(
 "nested_rule3",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " optional.of(cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false,"
 + " \"ir\": false}, (resource.origin in variables.banned_regions && !(resource.origin"
 + " in variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"})) : (!(resource.origin in variables.permitted_regions)"
 + " ? optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? optional.of((@index0 in {\"us\":"
 + " false, \"ru\": false, \"ir\": false} && @index1) ? {\"banned\":"
 + " \"restricted_region\"} : {\"banned\": \"bad_actor\"}) : (@index1 ?"
 + " optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 REQUIRED_LABELS(
 "required_labels",
 true,
 ""
 + "cel.bind(variables.want, spec.labels, cel.bind(variables.missing, "
 + "variables.want.filter(l, !(l in resource.labels)), cel.bind(variables.invalid, "
 + "resource.labels.filter(l, l in variables.want && variables.want[l] != "
 + "resource.labels[l]), (variables.missing.size() > 0) ? "
 + "optional.of(\"missing one or more required labels: [\"\" + "
 + "variables.missing.join(\",\") + \"\"]\") : ((variables.invalid.size() > 0) ? "
 + "optional.of(\"invalid values provided on one or more labels: [\"\" + "
 + "variables.invalid.join(\",\") + \"\"]\") : optional.none()))))"),
 "cel.@block([spec.labels.filter(@it:0:0, !(@it:0:0 in resource.labels)), spec.labels,"
 + " resource.labels, @index2.filter(@it:0:0, @it:0:0 in @index1 && @index1[@it:0:0] !="
 + " @index2[@it:0:0])], (@index0.size() > 0) ? optional.of(\"missing one or more"
 + " required labels: [\"\" + @index0.join(\",\") + \"\"]\") : ((@index3.size() > 0) ?"
 + " optional.of(\"invalid values provided on one or more labels: [\"\" +"
 + " @index3.join(\",\") + \"\"]\") : optional.none()))"),
 RESTRICTED_DESTINATIONS(
 "restricted_destinations",
 false,
 "cel.bind(variables.matches_origin_ip, locationCode(origin.ip) == spec.origin,"
 + " cel.bind(variables.has_nationality, has(request.auth.claims.nationality),"
 + " cel.bind(variables.matches_nationality, variables.has_nationality &&"
 + " request.auth.claims.nationality == spec.origin, cel.bind(variables.matches_dest_ip,"
 + " locationCode(destination.ip) in spec.restricted_destinations,"
 + " cel.bind(variables.matches_dest_label, resource.labels.location in"
 + " spec.restricted_destinations, cel.bind(variables.matches_dest,"
 + " variables.matches_dest_ip || variables.matches_dest_label,"
 + " (variables.matches_nationality && variables.matches_dest) ? true :"
 + " ((!variables.has_nationality && variables.matches_origin_ip &&"
 + " variables.matches_dest) ? true : false)))))))"),
 "cel.@block([request.auth.claims, has(@index0.nationality), resource.labels.location in"
 + " spec.restricted_destinations], (@index1 && @index0.nationality == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " ((!@index1 && locationCode(origin.ip) == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " false))"),
 K8S(
 "k8s",
 true,
 "cel.bind(variables.env, resource.labels.?environment.orValue(\"prod\"),"
 + " cel.bind(variables.break_glass, resource.labels.?break_glass.orValue(\"false\") =="
 + " \"true\", !(variables.break_glass || resource.containers.all(c,"
 + " c.startsWith(variables.env + \".\"))) ? optional.of(\"only \" + variables.env + \""
 + " containers are allowed in namespace \" + resource.namespace) :"
 + " optional.none()))"),
 "cel.@block([resource.labels.?environment.orValue(\"prod\")],"
 + " !(resource.labels.?break_glass.orValue(\"false\") == \"true\" ||"
 + " resource.containers.all(@it:0:0, @it:0:0.startsWith(@index0 + \".\"))) ?"
 + " optional.of(\"only \" + @index0 + \" containers are allowed in namespace \" +"
 + " resource.namespace) : optional.none())"),
 PB(
 "pb",
 true,
 "(spec.single_int32 > TestAllTypes{single_int64: 10}.single_int64) ? optional.of(\"invalid"
 + " spec, got single_int32=\" + string(spec.single_int32) + \", wanted <= 10\") :"
 + " ((spec.standalone_enum == cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR"
 + " || dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 "cel.@block([spec.single_int32], (@index0 > 10) ? optional.of(\"invalid spec, got"
 + " single_int32=\" + string(@index0) + \", wanted <= 10\") : ((spec.standalone_enum =="
 + " cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR ||"
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGOO) ? optional.of(\"invalid"
 + " spec, neither nested nor imported enums may refer to BAR\") :"
 + " optional.none())"),
 + " spec, neither nested nor imported enums may refer to BAR\") : optional.none()))"),
 LIMITS(
 "limits",
 true,
 "cel.bind(variables.greeting, \"hello\", cel.bind(variables.farewell, \"goodbye\","
 + " cel.bind(variables.person, \"me\", cel.bind(variables.message_fmt, \"%s, %s\","
 + " (now.getHours() >= 20) ? cel.bind(variables.message, variables.farewell + \", \" +"
 + " variables.person, (now.getHours() < 21) ? optional.of(variables.message + \"!\") :"
 + " ((now.getHours() < 22) ? optional.of(variables.message + \"!!\") : ((now.getHours()"
 + " < 24) ? optional.of(variables.message + \"!!!\") : optional.none()))) :"
 + " optional.of(variables.greeting + \", \" + variables.person)))))");
 "cel.@block([now.getHours()], (@index0 >= 20) ? ((@index0 < 21) ? optional.of(\"goodbye,"
 + " me!\") : ((@index0 < 22) ? optional.of(\"goodbye, me!!\") : ((@index0 < 24) ?"
 + " optional.of(\"goodbye, me!!!\") : optional.none()))) : optional.of(\"hello,"
 + " me\"))");

 private final String name;
 private final boolean producesOptionalResult;
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Optimize composed policies using Constant Folding and Common Subexpression Elimination#793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

copybara-service
merged 1 commit into

from

Sep 2, 2025
 Merged


Optimize composed policies using Constant Folding and Common Subexpression Elimination
#793
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 6 additions & 1 deletion
optimizer/src/main/java/dev/cel/optimizer/optimizers/ConstantFoldingOptimizer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,7 @@
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.ast.CelMutableExpr;
import dev.cel.common.ast.CelMutableExpr.CelMutableCall;
import dev.cel.common.ast.CelMutableExpr.CelMutableComprehension;
import dev.cel.common.ast.CelMutableExpr.CelMutableList;
import dev.cel.common.ast.CelMutableExpr.CelMutableMap;
import dev.cel.common.ast.CelMutableExpr.CelMutableStruct;
Expand DownExpand Up@@ -202,7 +203,11 @@ private static boolean canFoldInOperator(CelNavigableMutableExpr navigableExpr)
 CelNavigableMutableExpr parent = identNode.parent().orElse(null);
 while (parent != null) {
 if (parent.getKind().equals(Kind.COMPREHENSION)) {
 if (parent.expr().comprehension().accuVar().equals(identNode.expr().ident().name())) {
 String identName = identNode.expr().ident().name();
 CelMutableComprehension parentComprehension = parent.expr().comprehension();
 if (parentComprehension.accuVar().equals(identName)
 || parentComprehension.iterVar().equals(identName)
 || parentComprehension.iterVar2().equals(identName)) {
 // Prevent folding a subexpression if it contains a variable declared by a
 // comprehension. The subexpression cannot be compiled without the full context of the
 // surrounding comprehension.
Expand Down

2 changes: 1 addition & 1 deletion
parser/src/main/java/dev/cel/parser/Operator.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -180,7 +180,7 @@ static Optional<Operator> find(String text) {
 .put(MODULO.getFunction(), "%")
 .buildOrThrow();

 /** Lookup an operator by its mangled name, as used within the AST. */
 /** Lookup an operator by its mangled name (ex: _&&_), as used within the AST. */
 public static Optional<Operator> findReverse(String op) {
 return Optional.ofNullable(REVERSE_OPERATORS.get(op));
 }
Expand Down

4 changes: 4 additions & 0 deletions
policy/src/main/java/dev/cel/policy/BUILD.bazel

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,6 +215,8 @@ java_library(
 "//optimizer",
 "//optimizer:optimization_exception",
 "//optimizer:optimizer_builder",
 "//optimizer/optimizers:common_subexpression_elimination",
 "//optimizer/optimizers:constant_folding",
 "//validator",
 "//validator:ast_validator",
 "//validator:validator_builder",
Expand DownExpand Up@@ -247,7 +249,9 @@ java_library(
 "//common:cel_ast",
 "//common:compiler_common",
 "//common:mutable_ast",
 "//common/ast",
 "//common/formats:value_string",
 "//common/navigation:mutable_navigation",
 "//extensions:optional_library",
 "//optimizer:ast_optimizer",
 "//optimizer:mutable_ast",
Expand Down

29 changes: 27 additions & 2 deletions
policy/src/main/java/dev/cel/policy/CelPolicyCompilerImpl.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -36,6 +36,9 @@
import dev.cel.optimizer.CelOptimizationException;
import dev.cel.optimizer.CelOptimizer;
import dev.cel.optimizer.CelOptimizerFactory;
import dev.cel.optimizer.optimizers.ConstantFoldingOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer.SubexpressionOptimizerOptions;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result.Kind;
Expand DownExpand Up@@ -98,7 +101,7 @@ public CelCompiledRule compileRule(CelPolicy policy) throws CelPolicyValidationE
 public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledRule)
 throws CelPolicyValidationException {
 Cel cel = compiledRule.cel();
 CelOptimizer optimizer =
 CelOptimizer composingOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 RuleComposer.newInstance(compiledRule, variablesPrefix, iterationLimit))
Expand All@@ -110,7 +113,7 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 // This is a minimal expression used as a basis of stitching together all the rules into a
 // single graph.
 ast = cel.compile("true").getAst();
 ast = optimizer.optimize(ast);
 ast = composingOptimizer.optimize(ast);
 } catch (CelValidationException | CelOptimizationException e) {
 if (e.getCause() instanceof RuleCompositionException) {
 RuleCompositionException re = (RuleCompositionException) e.getCause();
Expand All@@ -136,6 +139,28 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 throw new CelPolicyValidationException("Unexpected error while composing rules.", e);
 }

 CelOptimizer astOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 ConstantFoldingOptimizer.getInstance(),
 SubexpressionOptimizer.newInstance(
 SubexpressionOptimizerOptions.newBuilder()
 // "record" is used for recording subexpression results via
 // BlueprintLateFunctionBinding. Safely eliminable, since repeated
 // invocation does not change the intermediate results.
 .addEliminableFunctions("record")
 .populateMacroCalls(true)
 .enableCelBlock(true)
 .build()))
 .build();
 try {
 // Optimize the composed graph using const fold and CSE
 ast = astOptimizer.optimize(ast);
 } catch (CelOptimizationException e) {
 throw new CelPolicyValidationException(
 "Failed to optimize the composed policy. Reason: " + e.getMessage(), e);
 }

 assertAstDepthIsSafe(ast, cel);

 return ast;
Expand Down

40 changes: 29 additions & 11 deletions
policy/src/main/java/dev/cel/policy/RuleComposer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,12 +19,16 @@
import static java.util.stream.Collectors.toCollection;

import com.google.auto.value.AutoValue;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Lists;
import dev.cel.bundle.Cel;
import dev.cel.common.CelAbstractSyntaxTree;
import dev.cel.common.CelMutableAst;
import dev.cel.common.CelValidationException;
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.formats.ValueString;
import dev.cel.common.navigation.CelNavigableMutableAst;
import dev.cel.common.navigation.CelNavigableMutableExpr;
import dev.cel.extensions.CelOptionalLibrary.Function;
import dev.cel.optimizer.AstMutator;
import dev.cel.optimizer.CelAstOptimizer;
Expand DownExpand Up@@ -151,23 +155,37 @@ private RuleOptimizationResult optimizeRule(Cel cel, CelCompiledRule compiledRul
 }
 }

 CelMutableAst result = matchAst;
 for (CelCompiledVariable variable : Lists.reverse(compiledRule.variables())) {
 result =
 astMutator.replaceSubtreeWithNewBindMacro(
 result,
 variablePrefix + variable.name(),
 CelMutableAst.fromCelAst(variable.ast()),
 result.expr(),
 result.expr().id(),
 true);
 }
 CelMutableAst result = inlineCompiledVariables(matchAst, compiledRule.variables());

 result = astMutator.renumberIdsConsecutively(result);

 return RuleOptimizationResult.create(result, isOptionalResult);
 }

 private CelMutableAst inlineCompiledVariables(
 CelMutableAst ast, List<CelCompiledVariable> compiledVariables) {
 CelMutableAst mutatedAst = ast;
 for (CelCompiledVariable compiledVariable : Lists.reverse(compiledVariables)) {
 String variableName = variablePrefix + compiledVariable.name();
 ImmutableList<CelNavigableMutableExpr> exprsToReplace =
 CelNavigableMutableAst.fromAst(mutatedAst)
 .getRoot()
 .allNodes()
 .filter(
 node ->
 node.expr().getKind().equals(Kind.IDENT)
 && node.expr().ident().name().equals(variableName))
 .collect(toImmutableList());

 for (CelNavigableMutableExpr expr : exprsToReplace) {
 CelMutableAst variableAst = CelMutableAst.fromCelAst(compiledVariable.ast());
 mutatedAst = astMutator.replaceSubtree(mutatedAst, variableAst, expr.id());
 }
 }

 return mutatedAst;
 }

 static RuleComposer newInstance(
 CelCompiledRule compiledRule, String variablePrefix, int iterationLimit) {
 return new RuleComposer(compiledRule, variablePrefix, iterationLimit);
Expand Down

32 changes: 28 additions & 4 deletions
policy/src/test/java/dev/cel/policy/CelPolicyCompilerImplTest.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,8 +136,8 @@ public void compileYamlPolicy_multilineContainsError_throws(

 @Test
 public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Exception {
String longExpr =
 "0+1+2+3+4+5+6+7+8+9+10+11+12+13+14+15+16+17+18+19+20+21+22+23+24+25+26+27+28+29+30+31+32+33+34+35+36+37+38+39+40+41+42+43+44+45+46+47+48+49+50";
Cel cel = newCel().toCelBuilder().addVar("msg", SimpleType.DYN).build();
String longExpr = "msg.b.c.d.e.f";
 String policyContent =
 String.format(
 "name: deeply_nested_ast\n" + "rule:\n" + " match:\n" + " - output: %s", longExpr);
Expand All@@ -146,11 +146,35 @@ public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Except
 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 () ->
 CelPolicyCompilerFactory.newPolicyCompiler(cel)
 .setAstDepthLimit(5)
 .build()
 .compile(policy));

 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 5.");
 }

 @Test
 public void compileYamlPolicy_constantFoldingFailure_throwsDuringComposition() throws Exception {
 String policyContent =
 "name: ast_with_div_by_zero\n" //
 + "rule:\n" //
 + " match:\n" //
 + " - output: 1 / 0";
 CelPolicy policy = POLICY_PARSER.parse(policyContent);

 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 50.");
 .isEqualTo(
 "Failed to optimize the composed policy. Reason: Constant folding failure. Failed to"
 + " evaluate subtree due to: evaluation error: / by zero");
 }

 @Test
Expand Down

100 changes: 40 additions & 60 deletions
policy/src/test/java/dev/cel/policy/PolicyTestHelper.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,88 +41,68 @@ enum TestYamlPolicy {
 NESTED_RULE(
 "nested_rule",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && "
 + "!(resource.origin in variables.permitted_regions)) "
 + "? optional.of({\"banned\": true}) : optional.none()).or("
 + "optional.of((resource.origin in variables.permitted_regions)"
 + " ? {\"banned\": false} : {\"banned\": true})))"),
 "cel.@block([resource.origin, @index0 in [\"us\", \"uk\", \"es\"], {\"banned\": true}],"
 + " ((@index0 in {\"us\": false, \"ru\": false, \"ir\": false} && !@index1) ?"
 + " optional.of(@index2) : optional.none()).or(optional.of(@index1 ? {\"banned\":"
 + " false} : @index2)))"),
 NESTED_RULE2(
 "nested_rule2",
 false,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && !(resource.origin in"
 + " variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} : {\"banned\":"
 + " \"bad_actor\"}) : (!(resource.origin in variables.permitted_regions) ? {\"banned\":"
 + " \"unconfigured_region\"} : {}))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? ((@index0 in {\"us\": false,"
 + " \"ru\": false, \"ir\": false} && @index1) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"}) : (@index1 ? {\"banned\": \"unconfigured_region\"} :"
 + " {}))"),
 NESTED_RULE3(
 "nested_rule3",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " optional.of(cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false,"
 + " \"ir\": false}, (resource.origin in variables.banned_regions && !(resource.origin"
 + " in variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"})) : (!(resource.origin in variables.permitted_regions)"
 + " ? optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? optional.of((@index0 in {\"us\":"
 + " false, \"ru\": false, \"ir\": false} && @index1) ? {\"banned\":"
 + " \"restricted_region\"} : {\"banned\": \"bad_actor\"}) : (@index1 ?"
 + " optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 REQUIRED_LABELS(
 "required_labels",
 true,
 ""
 + "cel.bind(variables.want, spec.labels, cel.bind(variables.missing, "
 + "variables.want.filter(l, !(l in resource.labels)), cel.bind(variables.invalid, "
 + "resource.labels.filter(l, l in variables.want && variables.want[l] != "
 + "resource.labels[l]), (variables.missing.size() > 0) ? "
 + "optional.of(\"missing one or more required labels: [\"\" + "
 + "variables.missing.join(\",\") + \"\"]\") : ((variables.invalid.size() > 0) ? "
 + "optional.of(\"invalid values provided on one or more labels: [\"\" + "
 + "variables.invalid.join(\",\") + \"\"]\") : optional.none()))))"),
 "cel.@block([spec.labels.filter(@it:0:0, !(@it:0:0 in resource.labels)), spec.labels,"
 + " resource.labels, @index2.filter(@it:0:0, @it:0:0 in @index1 && @index1[@it:0:0] !="
 + " @index2[@it:0:0])], (@index0.size() > 0) ? optional.of(\"missing one or more"
 + " required labels: [\"\" + @index0.join(\",\") + \"\"]\") : ((@index3.size() > 0) ?"
 + " optional.of(\"invalid values provided on one or more labels: [\"\" +"
 + " @index3.join(\",\") + \"\"]\") : optional.none()))"),
 RESTRICTED_DESTINATIONS(
 "restricted_destinations",
 false,
 "cel.bind(variables.matches_origin_ip, locationCode(origin.ip) == spec.origin,"
 + " cel.bind(variables.has_nationality, has(request.auth.claims.nationality),"
 + " cel.bind(variables.matches_nationality, variables.has_nationality &&"
 + " request.auth.claims.nationality == spec.origin, cel.bind(variables.matches_dest_ip,"
 + " locationCode(destination.ip) in spec.restricted_destinations,"
 + " cel.bind(variables.matches_dest_label, resource.labels.location in"
 + " spec.restricted_destinations, cel.bind(variables.matches_dest,"
 + " variables.matches_dest_ip || variables.matches_dest_label,"
 + " (variables.matches_nationality && variables.matches_dest) ? true :"
 + " ((!variables.has_nationality && variables.matches_origin_ip &&"
 + " variables.matches_dest) ? true : false)))))))"),
 "cel.@block([request.auth.claims, has(@index0.nationality), resource.labels.location in"
 + " spec.restricted_destinations], (@index1 && @index0.nationality == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " ((!@index1 && locationCode(origin.ip) == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " false))"),
 K8S(
 "k8s",
 true,
 "cel.bind(variables.env, resource.labels.?environment.orValue(\"prod\"),"
 + " cel.bind(variables.break_glass, resource.labels.?break_glass.orValue(\"false\") =="
 + " \"true\", !(variables.break_glass || resource.containers.all(c,"
 + " c.startsWith(variables.env + \".\"))) ? optional.of(\"only \" + variables.env + \""
 + " containers are allowed in namespace \" + resource.namespace) :"
 + " optional.none()))"),
 "cel.@block([resource.labels.?environment.orValue(\"prod\")],"
 + " !(resource.labels.?break_glass.orValue(\"false\") == \"true\" ||"
 + " resource.containers.all(@it:0:0, @it:0:0.startsWith(@index0 + \".\"))) ?"
 + " optional.of(\"only \" + @index0 + \" containers are allowed in namespace \" +"
 + " resource.namespace) : optional.none())"),
 PB(
 "pb",
 true,
 "(spec.single_int32 > TestAllTypes{single_int64: 10}.single_int64) ? optional.of(\"invalid"
 + " spec, got single_int32=\" + string(spec.single_int32) + \", wanted <= 10\") :"
 + " ((spec.standalone_enum == cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR"
 + " || dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 "cel.@block([spec.single_int32], (@index0 > 10) ? optional.of(\"invalid spec, got"
 + " single_int32=\" + string(@index0) + \", wanted <= 10\") : ((spec.standalone_enum =="
 + " cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR ||"
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGOO) ? optional.of(\"invalid"
 + " spec, neither nested nor imported enums may refer to BAR\") :"
 + " optional.none())"),
 + " spec, neither nested nor imported enums may refer to BAR\") : optional.none()))"),
 LIMITS(
 "limits",
 true,
 "cel.bind(variables.greeting, \"hello\", cel.bind(variables.farewell, \"goodbye\","
 + " cel.bind(variables.person, \"me\", cel.bind(variables.message_fmt, \"%s, %s\","
 + " (now.getHours() >= 20) ? cel.bind(variables.message, variables.farewell + \", \" +"
 + " variables.person, (now.getHours() < 21) ? optional.of(variables.message + \"!\") :"
 + " ((now.getHours() < 22) ? optional.of(variables.message + \"!!\") : ((now.getHours()"
 + " < 24) ? optional.of(variables.message + \"!!!\") : optional.none()))) :"
 + " optional.of(variables.greeting + \", \" + variables.person)))))");
 "cel.@block([now.getHours()], (@index0 >= 20) ? ((@index0 < 21) ? optional.of(\"goodbye,"
 + " me!\") : ((@index0 < 22) ? optional.of(\"goodbye, me!!\") : ((@index0 < 24) ?"
 + " optional.of(\"goodbye, me!!!\") : optional.none()))) : optional.of(\"hello,"
 + " me\"))");

 private final String name;
 private final boolean producesOptionalResult;
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Optimize composed policies using Constant Folding and Common Subexpression Elimination#793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

copybara-service
merged 1 commit into

from

Sep 2, 2025
 Merged


Optimize composed policies using Constant Folding and Common Subexpression Elimination
#793
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 6 additions & 1 deletion
optimizer/src/main/java/dev/cel/optimizer/optimizers/ConstantFoldingOptimizer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,7 @@
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.ast.CelMutableExpr;
import dev.cel.common.ast.CelMutableExpr.CelMutableCall;
import dev.cel.common.ast.CelMutableExpr.CelMutableComprehension;
import dev.cel.common.ast.CelMutableExpr.CelMutableList;
import dev.cel.common.ast.CelMutableExpr.CelMutableMap;
import dev.cel.common.ast.CelMutableExpr.CelMutableStruct;
Expand DownExpand Up@@ -202,7 +203,11 @@ private static boolean canFoldInOperator(CelNavigableMutableExpr navigableExpr)
 CelNavigableMutableExpr parent = identNode.parent().orElse(null);
 while (parent != null) {
 if (parent.getKind().equals(Kind.COMPREHENSION)) {
 if (parent.expr().comprehension().accuVar().equals(identNode.expr().ident().name())) {
 String identName = identNode.expr().ident().name();
 CelMutableComprehension parentComprehension = parent.expr().comprehension();
 if (parentComprehension.accuVar().equals(identName)
 || parentComprehension.iterVar().equals(identName)
 || parentComprehension.iterVar2().equals(identName)) {
 // Prevent folding a subexpression if it contains a variable declared by a
 // comprehension. The subexpression cannot be compiled without the full context of the
 // surrounding comprehension.
Expand Down

2 changes: 1 addition & 1 deletion
parser/src/main/java/dev/cel/parser/Operator.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -180,7 +180,7 @@ static Optional<Operator> find(String text) {
 .put(MODULO.getFunction(), "%")
 .buildOrThrow();

 /** Lookup an operator by its mangled name, as used within the AST. */
 /** Lookup an operator by its mangled name (ex: _&&_), as used within the AST. */
 public static Optional<Operator> findReverse(String op) {
 return Optional.ofNullable(REVERSE_OPERATORS.get(op));
 }
Expand Down

4 changes: 4 additions & 0 deletions
policy/src/main/java/dev/cel/policy/BUILD.bazel

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,6 +215,8 @@ java_library(
 "//optimizer",
 "//optimizer:optimization_exception",
 "//optimizer:optimizer_builder",
 "//optimizer/optimizers:common_subexpression_elimination",
 "//optimizer/optimizers:constant_folding",
 "//validator",
 "//validator:ast_validator",
 "//validator:validator_builder",
Expand DownExpand Up@@ -247,7 +249,9 @@ java_library(
 "//common:cel_ast",
 "//common:compiler_common",
 "//common:mutable_ast",
 "//common/ast",
 "//common/formats:value_string",
 "//common/navigation:mutable_navigation",
 "//extensions:optional_library",
 "//optimizer:ast_optimizer",
 "//optimizer:mutable_ast",
Expand Down

29 changes: 27 additions & 2 deletions
policy/src/main/java/dev/cel/policy/CelPolicyCompilerImpl.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -36,6 +36,9 @@
import dev.cel.optimizer.CelOptimizationException;
import dev.cel.optimizer.CelOptimizer;
import dev.cel.optimizer.CelOptimizerFactory;
import dev.cel.optimizer.optimizers.ConstantFoldingOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer.SubexpressionOptimizerOptions;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result.Kind;
Expand DownExpand Up@@ -98,7 +101,7 @@ public CelCompiledRule compileRule(CelPolicy policy) throws CelPolicyValidationE
 public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledRule)
 throws CelPolicyValidationException {
 Cel cel = compiledRule.cel();
 CelOptimizer optimizer =
 CelOptimizer composingOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 RuleComposer.newInstance(compiledRule, variablesPrefix, iterationLimit))
Expand All@@ -110,7 +113,7 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 // This is a minimal expression used as a basis of stitching together all the rules into a
 // single graph.
 ast = cel.compile("true").getAst();
 ast = optimizer.optimize(ast);
 ast = composingOptimizer.optimize(ast);
 } catch (CelValidationException | CelOptimizationException e) {
 if (e.getCause() instanceof RuleCompositionException) {
 RuleCompositionException re = (RuleCompositionException) e.getCause();
Expand All@@ -136,6 +139,28 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 throw new CelPolicyValidationException("Unexpected error while composing rules.", e);
 }

 CelOptimizer astOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 ConstantFoldingOptimizer.getInstance(),
 SubexpressionOptimizer.newInstance(
 SubexpressionOptimizerOptions.newBuilder()
 // "record" is used for recording subexpression results via
 // BlueprintLateFunctionBinding. Safely eliminable, since repeated
 // invocation does not change the intermediate results.
 .addEliminableFunctions("record")
 .populateMacroCalls(true)
 .enableCelBlock(true)
 .build()))
 .build();
 try {
 // Optimize the composed graph using const fold and CSE
 ast = astOptimizer.optimize(ast);
 } catch (CelOptimizationException e) {
 throw new CelPolicyValidationException(
 "Failed to optimize the composed policy. Reason: " + e.getMessage(), e);
 }

 assertAstDepthIsSafe(ast, cel);

 return ast;
Expand Down

40 changes: 29 additions & 11 deletions
policy/src/main/java/dev/cel/policy/RuleComposer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,12 +19,16 @@
import static java.util.stream.Collectors.toCollection;

import com.google.auto.value.AutoValue;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Lists;
import dev.cel.bundle.Cel;
import dev.cel.common.CelAbstractSyntaxTree;
import dev.cel.common.CelMutableAst;
import dev.cel.common.CelValidationException;
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.formats.ValueString;
import dev.cel.common.navigation.CelNavigableMutableAst;
import dev.cel.common.navigation.CelNavigableMutableExpr;
import dev.cel.extensions.CelOptionalLibrary.Function;
import dev.cel.optimizer.AstMutator;
import dev.cel.optimizer.CelAstOptimizer;
Expand DownExpand Up@@ -151,23 +155,37 @@ private RuleOptimizationResult optimizeRule(Cel cel, CelCompiledRule compiledRul
 }
 }

 CelMutableAst result = matchAst;
 for (CelCompiledVariable variable : Lists.reverse(compiledRule.variables())) {
 result =
 astMutator.replaceSubtreeWithNewBindMacro(
 result,
 variablePrefix + variable.name(),
 CelMutableAst.fromCelAst(variable.ast()),
 result.expr(),
 result.expr().id(),
 true);
 }
 CelMutableAst result = inlineCompiledVariables(matchAst, compiledRule.variables());

 result = astMutator.renumberIdsConsecutively(result);

 return RuleOptimizationResult.create(result, isOptionalResult);
 }

 private CelMutableAst inlineCompiledVariables(
 CelMutableAst ast, List<CelCompiledVariable> compiledVariables) {
 CelMutableAst mutatedAst = ast;
 for (CelCompiledVariable compiledVariable : Lists.reverse(compiledVariables)) {
 String variableName = variablePrefix + compiledVariable.name();
 ImmutableList<CelNavigableMutableExpr> exprsToReplace =
 CelNavigableMutableAst.fromAst(mutatedAst)
 .getRoot()
 .allNodes()
 .filter(
 node ->
 node.expr().getKind().equals(Kind.IDENT)
 && node.expr().ident().name().equals(variableName))
 .collect(toImmutableList());

 for (CelNavigableMutableExpr expr : exprsToReplace) {
 CelMutableAst variableAst = CelMutableAst.fromCelAst(compiledVariable.ast());
 mutatedAst = astMutator.replaceSubtree(mutatedAst, variableAst, expr.id());
 }
 }

 return mutatedAst;
 }

 static RuleComposer newInstance(
 CelCompiledRule compiledRule, String variablePrefix, int iterationLimit) {
 return new RuleComposer(compiledRule, variablePrefix, iterationLimit);
Expand Down

32 changes: 28 additions & 4 deletions
policy/src/test/java/dev/cel/policy/CelPolicyCompilerImplTest.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,8 +136,8 @@ public void compileYamlPolicy_multilineContainsError_throws(

 @Test
 public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Exception {
String longExpr =
 "0+1+2+3+4+5+6+7+8+9+10+11+12+13+14+15+16+17+18+19+20+21+22+23+24+25+26+27+28+29+30+31+32+33+34+35+36+37+38+39+40+41+42+43+44+45+46+47+48+49+50";
Cel cel = newCel().toCelBuilder().addVar("msg", SimpleType.DYN).build();
String longExpr = "msg.b.c.d.e.f";
 String policyContent =
 String.format(
 "name: deeply_nested_ast\n" + "rule:\n" + " match:\n" + " - output: %s", longExpr);
Expand All@@ -146,11 +146,35 @@ public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Except
 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 () ->
 CelPolicyCompilerFactory.newPolicyCompiler(cel)
 .setAstDepthLimit(5)
 .build()
 .compile(policy));

 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 5.");
 }

 @Test
 public void compileYamlPolicy_constantFoldingFailure_throwsDuringComposition() throws Exception {
 String policyContent =
 "name: ast_with_div_by_zero\n" //
 + "rule:\n" //
 + " match:\n" //
 + " - output: 1 / 0";
 CelPolicy policy = POLICY_PARSER.parse(policyContent);

 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 50.");
 .isEqualTo(
 "Failed to optimize the composed policy. Reason: Constant folding failure. Failed to"
 + " evaluate subtree due to: evaluation error: / by zero");
 }

 @Test
Expand Down

100 changes: 40 additions & 60 deletions
policy/src/test/java/dev/cel/policy/PolicyTestHelper.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,88 +41,68 @@ enum TestYamlPolicy {
 NESTED_RULE(
 "nested_rule",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && "
 + "!(resource.origin in variables.permitted_regions)) "
 + "? optional.of({\"banned\": true}) : optional.none()).or("
 + "optional.of((resource.origin in variables.permitted_regions)"
 + " ? {\"banned\": false} : {\"banned\": true})))"),
 "cel.@block([resource.origin, @index0 in [\"us\", \"uk\", \"es\"], {\"banned\": true}],"
 + " ((@index0 in {\"us\": false, \"ru\": false, \"ir\": false} && !@index1) ?"
 + " optional.of(@index2) : optional.none()).or(optional.of(@index1 ? {\"banned\":"
 + " false} : @index2)))"),
 NESTED_RULE2(
 "nested_rule2",
 false,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && !(resource.origin in"
 + " variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} : {\"banned\":"
 + " \"bad_actor\"}) : (!(resource.origin in variables.permitted_regions) ? {\"banned\":"
 + " \"unconfigured_region\"} : {}))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? ((@index0 in {\"us\": false,"
 + " \"ru\": false, \"ir\": false} && @index1) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"}) : (@index1 ? {\"banned\": \"unconfigured_region\"} :"
 + " {}))"),
 NESTED_RULE3(
 "nested_rule3",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " optional.of(cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false,"
 + " \"ir\": false}, (resource.origin in variables.banned_regions && !(resource.origin"
 + " in variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"})) : (!(resource.origin in variables.permitted_regions)"
 + " ? optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? optional.of((@index0 in {\"us\":"
 + " false, \"ru\": false, \"ir\": false} && @index1) ? {\"banned\":"
 + " \"restricted_region\"} : {\"banned\": \"bad_actor\"}) : (@index1 ?"
 + " optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 REQUIRED_LABELS(
 "required_labels",
 true,
 ""
 + "cel.bind(variables.want, spec.labels, cel.bind(variables.missing, "
 + "variables.want.filter(l, !(l in resource.labels)), cel.bind(variables.invalid, "
 + "resource.labels.filter(l, l in variables.want && variables.want[l] != "
 + "resource.labels[l]), (variables.missing.size() > 0) ? "
 + "optional.of(\"missing one or more required labels: [\"\" + "
 + "variables.missing.join(\",\") + \"\"]\") : ((variables.invalid.size() > 0) ? "
 + "optional.of(\"invalid values provided on one or more labels: [\"\" + "
 + "variables.invalid.join(\",\") + \"\"]\") : optional.none()))))"),
 "cel.@block([spec.labels.filter(@it:0:0, !(@it:0:0 in resource.labels)), spec.labels,"
 + " resource.labels, @index2.filter(@it:0:0, @it:0:0 in @index1 && @index1[@it:0:0] !="
 + " @index2[@it:0:0])], (@index0.size() > 0) ? optional.of(\"missing one or more"
 + " required labels: [\"\" + @index0.join(\",\") + \"\"]\") : ((@index3.size() > 0) ?"
 + " optional.of(\"invalid values provided on one or more labels: [\"\" +"
 + " @index3.join(\",\") + \"\"]\") : optional.none()))"),
 RESTRICTED_DESTINATIONS(
 "restricted_destinations",
 false,
 "cel.bind(variables.matches_origin_ip, locationCode(origin.ip) == spec.origin,"
 + " cel.bind(variables.has_nationality, has(request.auth.claims.nationality),"
 + " cel.bind(variables.matches_nationality, variables.has_nationality &&"
 + " request.auth.claims.nationality == spec.origin, cel.bind(variables.matches_dest_ip,"
 + " locationCode(destination.ip) in spec.restricted_destinations,"
 + " cel.bind(variables.matches_dest_label, resource.labels.location in"
 + " spec.restricted_destinations, cel.bind(variables.matches_dest,"
 + " variables.matches_dest_ip || variables.matches_dest_label,"
 + " (variables.matches_nationality && variables.matches_dest) ? true :"
 + " ((!variables.has_nationality && variables.matches_origin_ip &&"
 + " variables.matches_dest) ? true : false)))))))"),
 "cel.@block([request.auth.claims, has(@index0.nationality), resource.labels.location in"
 + " spec.restricted_destinations], (@index1 && @index0.nationality == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " ((!@index1 && locationCode(origin.ip) == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " false))"),
 K8S(
 "k8s",
 true,
 "cel.bind(variables.env, resource.labels.?environment.orValue(\"prod\"),"
 + " cel.bind(variables.break_glass, resource.labels.?break_glass.orValue(\"false\") =="
 + " \"true\", !(variables.break_glass || resource.containers.all(c,"
 + " c.startsWith(variables.env + \".\"))) ? optional.of(\"only \" + variables.env + \""
 + " containers are allowed in namespace \" + resource.namespace) :"
 + " optional.none()))"),
 "cel.@block([resource.labels.?environment.orValue(\"prod\")],"
 + " !(resource.labels.?break_glass.orValue(\"false\") == \"true\" ||"
 + " resource.containers.all(@it:0:0, @it:0:0.startsWith(@index0 + \".\"))) ?"
 + " optional.of(\"only \" + @index0 + \" containers are allowed in namespace \" +"
 + " resource.namespace) : optional.none())"),
 PB(
 "pb",
 true,
 "(spec.single_int32 > TestAllTypes{single_int64: 10}.single_int64) ? optional.of(\"invalid"
 + " spec, got single_int32=\" + string(spec.single_int32) + \", wanted <= 10\") :"
 + " ((spec.standalone_enum == cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR"
 + " || dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 "cel.@block([spec.single_int32], (@index0 > 10) ? optional.of(\"invalid spec, got"
 + " single_int32=\" + string(@index0) + \", wanted <= 10\") : ((spec.standalone_enum =="
 + " cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR ||"
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGOO) ? optional.of(\"invalid"
 + " spec, neither nested nor imported enums may refer to BAR\") :"
 + " optional.none())"),
 + " spec, neither nested nor imported enums may refer to BAR\") : optional.none()))"),
 LIMITS(
 "limits",
 true,
 "cel.bind(variables.greeting, \"hello\", cel.bind(variables.farewell, \"goodbye\","
 + " cel.bind(variables.person, \"me\", cel.bind(variables.message_fmt, \"%s, %s\","
 + " (now.getHours() >= 20) ? cel.bind(variables.message, variables.farewell + \", \" +"
 + " variables.person, (now.getHours() < 21) ? optional.of(variables.message + \"!\") :"
 + " ((now.getHours() < 22) ? optional.of(variables.message + \"!!\") : ((now.getHours()"
 + " < 24) ? optional.of(variables.message + \"!!!\") : optional.none()))) :"
 + " optional.of(variables.greeting + \", \" + variables.person)))))");
 "cel.@block([now.getHours()], (@index0 >= 20) ? ((@index0 < 21) ? optional.of(\"goodbye,"
 + " me!\") : ((@index0 < 22) ? optional.of(\"goodbye, me!!\") : ((@index0 < 24) ?"
 + " optional.of(\"goodbye, me!!!\") : optional.none()))) : optional.of(\"hello,"
 + " me\"))");

 private final String name;
 private final boolean producesOptionalResult;
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Optimize composed policies using Constant Folding and Common Subexpression Elimination#793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

copybara-service
merged 1 commit into

from

Sep 2, 2025
 Merged


Optimize composed policies using Constant Folding and Common Subexpression Elimination
#793
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 6 additions & 1 deletion
optimizer/src/main/java/dev/cel/optimizer/optimizers/ConstantFoldingOptimizer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,7 @@
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.ast.CelMutableExpr;
import dev.cel.common.ast.CelMutableExpr.CelMutableCall;
import dev.cel.common.ast.CelMutableExpr.CelMutableComprehension;
import dev.cel.common.ast.CelMutableExpr.CelMutableList;
import dev.cel.common.ast.CelMutableExpr.CelMutableMap;
import dev.cel.common.ast.CelMutableExpr.CelMutableStruct;
Expand DownExpand Up@@ -202,7 +203,11 @@ private static boolean canFoldInOperator(CelNavigableMutableExpr navigableExpr)
 CelNavigableMutableExpr parent = identNode.parent().orElse(null);
 while (parent != null) {
 if (parent.getKind().equals(Kind.COMPREHENSION)) {
 if (parent.expr().comprehension().accuVar().equals(identNode.expr().ident().name())) {
 String identName = identNode.expr().ident().name();
 CelMutableComprehension parentComprehension = parent.expr().comprehension();
 if (parentComprehension.accuVar().equals(identName)
 || parentComprehension.iterVar().equals(identName)
 || parentComprehension.iterVar2().equals(identName)) {
 // Prevent folding a subexpression if it contains a variable declared by a
 // comprehension. The subexpression cannot be compiled without the full context of the
 // surrounding comprehension.
Expand Down

2 changes: 1 addition & 1 deletion
parser/src/main/java/dev/cel/parser/Operator.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -180,7 +180,7 @@ static Optional<Operator> find(String text) {
 .put(MODULO.getFunction(), "%")
 .buildOrThrow();

 /** Lookup an operator by its mangled name, as used within the AST. */
 /** Lookup an operator by its mangled name (ex: _&&_), as used within the AST. */
 public static Optional<Operator> findReverse(String op) {
 return Optional.ofNullable(REVERSE_OPERATORS.get(op));
 }
Expand Down

4 changes: 4 additions & 0 deletions
policy/src/main/java/dev/cel/policy/BUILD.bazel

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,6 +215,8 @@ java_library(
 "//optimizer",
 "//optimizer:optimization_exception",
 "//optimizer:optimizer_builder",
 "//optimizer/optimizers:common_subexpression_elimination",
 "//optimizer/optimizers:constant_folding",
 "//validator",
 "//validator:ast_validator",
 "//validator:validator_builder",
Expand DownExpand Up@@ -247,7 +249,9 @@ java_library(
 "//common:cel_ast",
 "//common:compiler_common",
 "//common:mutable_ast",
 "//common/ast",
 "//common/formats:value_string",
 "//common/navigation:mutable_navigation",
 "//extensions:optional_library",
 "//optimizer:ast_optimizer",
 "//optimizer:mutable_ast",
Expand Down

29 changes: 27 additions & 2 deletions
policy/src/main/java/dev/cel/policy/CelPolicyCompilerImpl.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -36,6 +36,9 @@
import dev.cel.optimizer.CelOptimizationException;
import dev.cel.optimizer.CelOptimizer;
import dev.cel.optimizer.CelOptimizerFactory;
import dev.cel.optimizer.optimizers.ConstantFoldingOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer;
import dev.cel.optimizer.optimizers.SubexpressionOptimizer.SubexpressionOptimizerOptions;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result;
import dev.cel.policy.CelCompiledRule.CelCompiledMatch.Result.Kind;
Expand DownExpand Up@@ -98,7 +101,7 @@ public CelCompiledRule compileRule(CelPolicy policy) throws CelPolicyValidationE
 public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledRule)
 throws CelPolicyValidationException {
 Cel cel = compiledRule.cel();
 CelOptimizer optimizer =
 CelOptimizer composingOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 RuleComposer.newInstance(compiledRule, variablesPrefix, iterationLimit))
Expand All@@ -110,7 +113,7 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 // This is a minimal expression used as a basis of stitching together all the rules into a
 // single graph.
 ast = cel.compile("true").getAst();
 ast = optimizer.optimize(ast);
 ast = composingOptimizer.optimize(ast);
 } catch (CelValidationException | CelOptimizationException e) {
 if (e.getCause() instanceof RuleCompositionException) {
 RuleCompositionException re = (RuleCompositionException) e.getCause();
Expand All@@ -136,6 +139,28 @@ public CelAbstractSyntaxTree compose(CelPolicy policy, CelCompiledRule compiledR
 throw new CelPolicyValidationException("Unexpected error while composing rules.", e);
 }

 CelOptimizer astOptimizer =
 CelOptimizerFactory.standardCelOptimizerBuilder(cel)
 .addAstOptimizers(
 ConstantFoldingOptimizer.getInstance(),
 SubexpressionOptimizer.newInstance(
 SubexpressionOptimizerOptions.newBuilder()
 // "record" is used for recording subexpression results via
 // BlueprintLateFunctionBinding. Safely eliminable, since repeated
 // invocation does not change the intermediate results.
 .addEliminableFunctions("record")
 .populateMacroCalls(true)
 .enableCelBlock(true)
 .build()))
 .build();
 try {
 // Optimize the composed graph using const fold and CSE
 ast = astOptimizer.optimize(ast);
 } catch (CelOptimizationException e) {
 throw new CelPolicyValidationException(
 "Failed to optimize the composed policy. Reason: " + e.getMessage(), e);
 }

 assertAstDepthIsSafe(ast, cel);

 return ast;
Expand Down

40 changes: 29 additions & 11 deletions
policy/src/main/java/dev/cel/policy/RuleComposer.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,12 +19,16 @@
import static java.util.stream.Collectors.toCollection;

import com.google.auto.value.AutoValue;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Lists;
import dev.cel.bundle.Cel;
import dev.cel.common.CelAbstractSyntaxTree;
import dev.cel.common.CelMutableAst;
import dev.cel.common.CelValidationException;
import dev.cel.common.ast.CelExpr.ExprKind.Kind;
import dev.cel.common.formats.ValueString;
import dev.cel.common.navigation.CelNavigableMutableAst;
import dev.cel.common.navigation.CelNavigableMutableExpr;
import dev.cel.extensions.CelOptionalLibrary.Function;
import dev.cel.optimizer.AstMutator;
import dev.cel.optimizer.CelAstOptimizer;
Expand DownExpand Up@@ -151,23 +155,37 @@ private RuleOptimizationResult optimizeRule(Cel cel, CelCompiledRule compiledRul
 }
 }

 CelMutableAst result = matchAst;
 for (CelCompiledVariable variable : Lists.reverse(compiledRule.variables())) {
 result =
 astMutator.replaceSubtreeWithNewBindMacro(
 result,
 variablePrefix + variable.name(),
 CelMutableAst.fromCelAst(variable.ast()),
 result.expr(),
 result.expr().id(),
 true);
 }
 CelMutableAst result = inlineCompiledVariables(matchAst, compiledRule.variables());

 result = astMutator.renumberIdsConsecutively(result);

 return RuleOptimizationResult.create(result, isOptionalResult);
 }

 private CelMutableAst inlineCompiledVariables(
 CelMutableAst ast, List<CelCompiledVariable> compiledVariables) {
 CelMutableAst mutatedAst = ast;
 for (CelCompiledVariable compiledVariable : Lists.reverse(compiledVariables)) {
 String variableName = variablePrefix + compiledVariable.name();
 ImmutableList<CelNavigableMutableExpr> exprsToReplace =
 CelNavigableMutableAst.fromAst(mutatedAst)
 .getRoot()
 .allNodes()
 .filter(
 node ->
 node.expr().getKind().equals(Kind.IDENT)
 && node.expr().ident().name().equals(variableName))
 .collect(toImmutableList());

 for (CelNavigableMutableExpr expr : exprsToReplace) {
 CelMutableAst variableAst = CelMutableAst.fromCelAst(compiledVariable.ast());
 mutatedAst = astMutator.replaceSubtree(mutatedAst, variableAst, expr.id());
 }
 }

 return mutatedAst;
 }

 static RuleComposer newInstance(
 CelCompiledRule compiledRule, String variablePrefix, int iterationLimit) {
 return new RuleComposer(compiledRule, variablePrefix, iterationLimit);
Expand Down

32 changes: 28 additions & 4 deletions
policy/src/test/java/dev/cel/policy/CelPolicyCompilerImplTest.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,8 +136,8 @@ public void compileYamlPolicy_multilineContainsError_throws(

 @Test
 public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Exception {
String longExpr =
 "0+1+2+3+4+5+6+7+8+9+10+11+12+13+14+15+16+17+18+19+20+21+22+23+24+25+26+27+28+29+30+31+32+33+34+35+36+37+38+39+40+41+42+43+44+45+46+47+48+49+50";
Cel cel = newCel().toCelBuilder().addVar("msg", SimpleType.DYN).build();
String longExpr = "msg.b.c.d.e.f";
 String policyContent =
 String.format(
 "name: deeply_nested_ast\n" + "rule:\n" + " match:\n" + " - output: %s", longExpr);
Expand All@@ -146,11 +146,35 @@ public void compileYamlPolicy_exceedsDefaultAstDepthLimit_throws() throws Except
 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 () ->
 CelPolicyCompilerFactory.newPolicyCompiler(cel)
 .setAstDepthLimit(5)
 .build()
 .compile(policy));

 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 5.");
 }

 @Test
 public void compileYamlPolicy_constantFoldingFailure_throwsDuringComposition() throws Exception {
 String policyContent =
 "name: ast_with_div_by_zero\n" //
 + "rule:\n" //
 + " match:\n" //
 + " - output: 1 / 0";
 CelPolicy policy = POLICY_PARSER.parse(policyContent);

 CelPolicyValidationException e =
 assertThrows(
 CelPolicyValidationException.class,
 () -> CelPolicyCompilerFactory.newPolicyCompiler(newCel()).build().compile(policy));
 assertThat(e)
 .hasMessageThat()
 .isEqualTo("ERROR: <input>:-1:0: AST's depth exceeds the configured limit: 50.");
 .isEqualTo(
 "Failed to optimize the composed policy. Reason: Constant folding failure. Failed to"
 + " evaluate subtree due to: evaluation error: / by zero");
 }

 @Test
Expand Down

100 changes: 40 additions & 60 deletions
policy/src/test/java/dev/cel/policy/PolicyTestHelper.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,88 +41,68 @@ enum TestYamlPolicy {
 NESTED_RULE(
 "nested_rule",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && "
 + "!(resource.origin in variables.permitted_regions)) "
 + "? optional.of({\"banned\": true}) : optional.none()).or("
 + "optional.of((resource.origin in variables.permitted_regions)"
 + " ? {\"banned\": false} : {\"banned\": true})))"),
 "cel.@block([resource.origin, @index0 in [\"us\", \"uk\", \"es\"], {\"banned\": true}],"
 + " ((@index0 in {\"us\": false, \"ru\": false, \"ir\": false} && !@index1) ?"
 + " optional.of(@index2) : optional.none()).or(optional.of(@index1 ? {\"banned\":"
 + " false} : @index2)))"),
 NESTED_RULE2(
 "nested_rule2",
 false,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false, \"ir\": false},"
 + " (resource.origin in variables.banned_regions && !(resource.origin in"
 + " variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} : {\"banned\":"
 + " \"bad_actor\"}) : (!(resource.origin in variables.permitted_regions) ? {\"banned\":"
 + " \"unconfigured_region\"} : {}))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? ((@index0 in {\"us\": false,"
 + " \"ru\": false, \"ir\": false} && @index1) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"}) : (@index1 ? {\"banned\": \"unconfigured_region\"} :"
 + " {}))"),
 NESTED_RULE3(
 "nested_rule3",
 true,
 "cel.bind(variables.permitted_regions, [\"us\", \"uk\", \"es\"],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ?"
 + " optional.of(cel.bind(variables.banned_regions, {\"us\": false, \"ru\": false,"
 + " \"ir\": false}, (resource.origin in variables.banned_regions && !(resource.origin"
 + " in variables.permitted_regions)) ? {\"banned\": \"restricted_region\"} :"
 + " {\"banned\": \"bad_actor\"})) : (!(resource.origin in variables.permitted_regions)"
 + " ? optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 "cel.@block([resource.origin, !(@index0 in [\"us\", \"uk\", \"es\"])],"
 + " resource.?user.orValue(\"\").startsWith(\"bad\") ? optional.of((@index0 in {\"us\":"
 + " false, \"ru\": false, \"ir\": false} && @index1) ? {\"banned\":"
 + " \"restricted_region\"} : {\"banned\": \"bad_actor\"}) : (@index1 ?"
 + " optional.of({\"banned\": \"unconfigured_region\"}) : optional.none()))"),
 REQUIRED_LABELS(
 "required_labels",
 true,
 ""
 + "cel.bind(variables.want, spec.labels, cel.bind(variables.missing, "
 + "variables.want.filter(l, !(l in resource.labels)), cel.bind(variables.invalid, "
 + "resource.labels.filter(l, l in variables.want && variables.want[l] != "
 + "resource.labels[l]), (variables.missing.size() > 0) ? "
 + "optional.of(\"missing one or more required labels: [\"\" + "
 + "variables.missing.join(\",\") + \"\"]\") : ((variables.invalid.size() > 0) ? "
 + "optional.of(\"invalid values provided on one or more labels: [\"\" + "
 + "variables.invalid.join(\",\") + \"\"]\") : optional.none()))))"),
 "cel.@block([spec.labels.filter(@it:0:0, !(@it:0:0 in resource.labels)), spec.labels,"
 + " resource.labels, @index2.filter(@it:0:0, @it:0:0 in @index1 && @index1[@it:0:0] !="
 + " @index2[@it:0:0])], (@index0.size() > 0) ? optional.of(\"missing one or more"
 + " required labels: [\"\" + @index0.join(\",\") + \"\"]\") : ((@index3.size() > 0) ?"
 + " optional.of(\"invalid values provided on one or more labels: [\"\" +"
 + " @index3.join(\",\") + \"\"]\") : optional.none()))"),
 RESTRICTED_DESTINATIONS(
 "restricted_destinations",
 false,
 "cel.bind(variables.matches_origin_ip, locationCode(origin.ip) == spec.origin,"
 + " cel.bind(variables.has_nationality, has(request.auth.claims.nationality),"
 + " cel.bind(variables.matches_nationality, variables.has_nationality &&"
 + " request.auth.claims.nationality == spec.origin, cel.bind(variables.matches_dest_ip,"
 + " locationCode(destination.ip) in spec.restricted_destinations,"
 + " cel.bind(variables.matches_dest_label, resource.labels.location in"
 + " spec.restricted_destinations, cel.bind(variables.matches_dest,"
 + " variables.matches_dest_ip || variables.matches_dest_label,"
 + " (variables.matches_nationality && variables.matches_dest) ? true :"
 + " ((!variables.has_nationality && variables.matches_origin_ip &&"
 + " variables.matches_dest) ? true : false)))))))"),
 "cel.@block([request.auth.claims, has(@index0.nationality), resource.labels.location in"
 + " spec.restricted_destinations], (@index1 && @index0.nationality == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " ((!@index1 && locationCode(origin.ip) == spec.origin &&"
 + " (locationCode(destination.ip) in spec.restricted_destinations || @index2)) ? true :"
 + " false))"),
 K8S(
 "k8s",
 true,
 "cel.bind(variables.env, resource.labels.?environment.orValue(\"prod\"),"
 + " cel.bind(variables.break_glass, resource.labels.?break_glass.orValue(\"false\") =="
 + " \"true\", !(variables.break_glass || resource.containers.all(c,"
 + " c.startsWith(variables.env + \".\"))) ? optional.of(\"only \" + variables.env + \""
 + " containers are allowed in namespace \" + resource.namespace) :"
 + " optional.none()))"),
 "cel.@block([resource.labels.?environment.orValue(\"prod\")],"
 + " !(resource.labels.?break_glass.orValue(\"false\") == \"true\" ||"
 + " resource.containers.all(@it:0:0, @it:0:0.startsWith(@index0 + \".\"))) ?"
 + " optional.of(\"only \" + @index0 + \" containers are allowed in namespace \" +"
 + " resource.namespace) : optional.none())"),
 PB(
 "pb",
 true,
 "(spec.single_int32 > TestAllTypes{single_int64: 10}.single_int64) ? optional.of(\"invalid"
 + " spec, got single_int32=\" + string(spec.single_int32) + \", wanted <= 10\") :"
 + " ((spec.standalone_enum == cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR"
 + " || dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 "cel.@block([spec.single_int32], (@index0 > 10) ? optional.of(\"invalid spec, got"
 + " single_int32=\" + string(@index0) + \", wanted <= 10\") : ((spec.standalone_enum =="
 + " cel.expr.conformance.proto3.TestAllTypes.NestedEnum.BAR ||"
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGAR =="
 + " dev.cel.testing.testdata.proto3.StandaloneGlobalEnum.SGOO) ? optional.of(\"invalid"
 + " spec, neither nested nor imported enums may refer to BAR\") :"
 + " optional.none())"),
 + " spec, neither nested nor imported enums may refer to BAR\") : optional.none()))"),
 LIMITS(
 "limits",
 true,
 "cel.bind(variables.greeting, \"hello\", cel.bind(variables.farewell, \"goodbye\","
 + " cel.bind(variables.person, \"me\", cel.bind(variables.message_fmt, \"%s, %s\","
 + " (now.getHours() >= 20) ? cel.bind(variables.message, variables.farewell + \", \" +"
 + " variables.person, (now.getHours() < 21) ? optional.of(variables.message + \"!\") :"
 + " ((now.getHours() < 22) ? optional.of(variables.message + \"!!\") : ((now.getHours()"
 + " < 24) ? optional.of(variables.message + \"!!!\") : optional.none()))) :"
 + " optional.of(variables.greeting + \", \" + variables.person)))))");
 "cel.@block([now.getHours()], (@index0 >= 20) ? ((@index0 < 21) ? optional.of(\"goodbye,"
 + " me!\") : ((@index0 < 22) ? optional.of(\"goodbye, me!!\") : ((@index0 < 24) ?"
 + " optional.of(\"goodbye, me!!!\") : optional.none()))) : optional.of(\"hello,"
 + " me\"))");

 private final String name;
 private final boolean producesOptionalResult;
Expand Down
Loading
Loading