-
Incident report
-
Resolution: Won't fix
-
Trivial
-
None
-
3.0.0
Documentation says that supported item types for last() and prev() trigger functions are float, int, str, text, log and result type is same as input type. This leads to several problems.
- Confusion. Support of string output values of trigger functions makes user think that strings can be directly operated upon in expressions. For example, compared using "=", "<", ">", "<=", ">=" and "<>" operators. This is not true.
- Injection. Generally speaking, text value inserted instead of numeric value will break expression evaluation. But strings like "2+2" or "1G" can exploit our way of evaluating expressions and silently produce invalid result.
- Unexpected result. If someone will use previous "feature" intentionally, he might get not what he expects. For example, expression "2*{host:key.last()}" for "2+2" will evaluate to 6, not 8.
Different solutions are possible and therefore different components will need to be fixed.
- Prohibit last() and prev() usage for string, text and log items. I struggle to imagine any use for them without
ZBXNEXT-702/ZBXNEXT-1316functionality. - Validate values for being numeric before insertion like we do for macros.