Repository navigation
Allow a newline after a unary operation - #154
Open
basitalisandhu wants to merge 1 commit into
Open
basitalisandhu wants to merge 1 commit into
basitalisandhu wants to merge 1 commit into
Conversation
A unary operation (!x or -x) followed by a newline and a binary operator, such as a multi-line && chain inside a validation condition, failed with UnexpectedToken. A bare expr_term already absorbed trailing newlines; unary_op did not. Add the same slot to unary_op. Fixes bridgecrewio#153
basitalisandhu
force-pushed
the
fix-unary-op-newline
branch
from
October 13, 2026 11:58
79ba1b9 to
8da0a89
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #153 (reported to checkov as bridgecrewio/checkov#7713).
Problem
A unary operation followed by a newline and then a binary operator fails to parse:
UnexpectedToken Token('__ANON_5', '&&') at line 9, column 7. Terraform accepts this. checkov 3.3.19 to 3.3.22 pinbc-python-hcl2==0.4.3, so the whole file goes intoparsing_errorsand none of its resources get scanned.Cause and fix
In
hcl2/hcl2.lark, a bareexpr_termcan take trailing newlines (?expression : expr_term _NEW_LINE_OR_COMMENT* | ...), butunary_opcannot. So after!contains(...)and a newline, the parser can't continue intobinary_term. This change adds the same optional newline/comment slot afterunary_opin the?operationrule._NEW_LINE_OR_COMMENTis a filtered terminal and?operationis inlined, so the transformer output is unchanged.Testing
unary_operator_newline.tfwith its JSON covers!xthen&&,!xthen||,-xthen+, and a comment between. It fails on master and passes with the fix.pytest test/unit: 4 passed, 18 subtests passed (lark 1.3.1, Python 3.14). No LALR conflicts..tffiles (checkov'stests/terraform, plus terraform-aws-modules eks, vpc, iam and rds) with the old and new grammar. The JSON output is identical for every file, and the same 7 files fail both times (all intentionally invalid checkov fixtures, such asinvalid_terraform_syntax/andhcl_timeout/).