tree 928acf4d8d6386c32c14ccf2ad78dfb6c43b1ac8
parent c7c14fdad0cfba8386689cb2468d8ddc21d9cb1b
author Marcel van Lohuizen <mpvl@golang.org> 1599944655 +0200
committer Marcel van Lohuizen <mpvl@golang.org> 1600261712 +0000

cue/load: relax places where @tag is allowed

Currently @tag can already be arbitrarily nested.
This now also allows embeddings. It now explicitly
disallows fields defined within lists or the scope of
an optional field in the help. It also reports an error
for invalid tag attributes.

These restrictions avoid an injection from being spread
to widely by being generated, which may increase the
ability to analyze a configuration. But if these restrictions
prove to be too cumbersome, they could be removed.

Closes #437

Change-Id: I3af3a49adb20e67fcce7c6693d40bfd14aa8eb0b
Reviewed-on: https://cue-review.googlesource.com/c/cue/+/7082
Reviewed-by: Marcel van Lohuizen <mpvl@golang.org>