refactor: validate label / edge-triplet IDs at PropertyGraph API boundary#422
Merged
zhanglei1949 merged 3 commits intoJun 1, 2026
Merged
Conversation
…dary
Previously several PropertyGraph public APIs trusted caller-supplied
label_t / edge-triplet IDs without validation: mutating ops relied on
assert() (compiled out in Release) and non-Status accessors did no check
at all, so an invalid label_t became out-of-bounds vector access on
vertex_tables_[label] -- undefined behavior in Release.
- Add label_t overloads of vertex_label_check / edge_triplet_check, and
make all four overloads const + share logic (edge_triplet_check now
delegates per-vertex validation to vertex_label_check).
- Mutating APIs: replace asserts / missing checks with
RETURN_IF_NOT_OK(vertex_label_check / edge_triplet_check) so invalid
IDs surface as ERR_INVALID_ARGUMENT instead of UB.
- Non-Status accessors (get_vertex_table, GetVertexPropertyColumn,
GetVertexSet, LidNum, VertexNum, IsValidLid, get_lid, GetOid) now call
schema_.ensure_vertex_label_valid(...) -- throws InvalidArgumentException,
the only viable signal channel for non-Status returns.
- GetVertexPropertyColumn(label, col_id): also bounds-check col_id
against the label's property count.
- Unify error wording across string / label_t overloads ("Vertex label
'<name>' is not valid" / "Vertex label id <N> is not valid"; same
"Edge triplet <...> is not valid" shape) so behavior is consistent
regardless of which overload the caller hits.
No behavior change for valid inputs.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens PropertyGraph’s public API boundary by validating caller-supplied vertex label IDs and edge-triplet IDs before they can trigger undefined behavior (especially in Release builds where assert is compiled out), and it consolidates the internal validation helpers so string- and label_t-based call sites behave more consistently.
Changes:
- Introduces
label_toverloads forvertex_label_check/edge_triplet_checkand makes the helpersconst, with edge-triplet checks delegating per-vertex validation tovertex_label_check. - Replaces a number of
assert(...)-based checks in mutating APIs withRETURN_IF_NOT_OK(...)so invalid inputs returnERR_INVALID_ARGUMENTrather than risking UB. - Adds label validation for non-
Statusaccessors viaschema_.ensure_vertex_label_valid(...), and adds a new bounds check inGetVertexPropertyColumn(label, col_id).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
src/storages/graph/property_graph.cc |
Replaces assert-based validation with Status-returning checks; adds unified helper implementations for label/triplet validation. |
include/neug/storages/graph/property_graph.h |
Adds label validation to inline accessors and introduces a new column-id bounds check for GetVertexPropertyColumn(label, col_id). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
zhanglei1949
commented
Jun 1, 2026
| void loadSchema(const std::string& filename); | ||
| inline std::shared_ptr<RefColumnBase> GetVertexPropertyColumn( | ||
| uint8_t label, int32_t col_id) const { | ||
| schema_.ensure_vertex_label_valid(label); |
Member
Author
There was a problem hiding this comment.
returning null or throw exception?
liulx20
approved these changes
Jun 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What do these changes do?
Harden
PropertyGraph's label-id and edge-triplet validation so that bad caller-supplied IDs no longer become undefined behavior in Release builds, and unify the existing private check helpers so the string andlabel_toverloads behave consistently.label_toverloads of the private helpers and make all four overloadsconst. Bothedge_triplet_checkoverloads now delegate per-vertex validation tovertex_label_check, so they share logic and produce equally granular errors:BatchAddVertices,BatchDeleteVertices,DeleteVertex×2,DeleteEdge,BatchDeleteEdges×2,AddVertex,UpdateVertexProperty,UpdateEdgeProperty) nowRETURN_IF_NOT_OK(vertex_label_check(...) / edge_triplet_check(...))instead ofassert(...)or relying on the callee to catch the bad ID.get_vertex_table×2,GetVertexPropertyColumn×2,GetVertexSet,LidNum,VertexNum,IsValidLid,get_lid,GetOid) now callschema_.ensure_vertex_label_valid(...)(throwsInvalidArgumentException) — the only viable signal channel for non-Statusreturns.GetVertexPropertyColumn(label, col_id)additionally bounds-checkscol_idagainst the label's property count."Vertex label '<name>' is not valid"/"Vertex label id <N> is not valid"; same"Edge triplet <...> is not valid"shape. Drop theLOG(ERROR)calls from the existing string-based helpers (caller decides).No behavior change for valid inputs. Verified no tests assert on the old error wording.
Background
These changes were originally bundled inside the
zl/update-txn-cowbranch (PR #370 split work) but have no semantic dependency on the workspace/checkpoint or COW refactor. Splitting them out keeps those downstream PRs focused and lets this hardening land independently againstmain.Related issue number
Fixes #421