From 5ee1f2f2496d6d2da1adfbcb3e6d2ec59bc10d5a Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Mar 25 2026 14:28:15 +0000
Subject: [PATCH 1/2] add unit test for flag data leaks in policy


---

diff --git a/tests/test_lib/test_policy.py b/tests/test_lib/test_policy.py
index 954adec..d1ae353 100644
--- a/tests/test_lib/test_policy.py
+++ b/tests/test_lib/test_policy.py
@@ -463,6 +463,28 @@ all :: {
         action = obj.apply(data)
         self.assertEqual(action, 'OK')
 
+    def test_flag_leaks(self):
+        tests = koji.policy.findSimpleTests(koji.policy.__dict__)
+        data = {}
+
+        policy = '''
+        flagged bar :: BAD
+        flagged foo :: BAD
+        flagged baz :: BAD
+        true :: flag foo
+        false :: flag bar
+        flagged bar :: BAD
+        flagged foo :: OK
+        flagged baz :: BAD
+        '''
+        obj = koji.policy.SimpleRuleSet(policy.splitlines(), tests)
+        action = obj.apply(data)
+        self.assertEqual(action, 'OK')
+
+        # run again, to make sure flag does not persist
+        action = obj.apply(data)
+        self.assertEqual(action, 'OK')
+
     def test_complex_policy(self):
         tests = koji.policy.findSimpleTests(koji.policy.__dict__)
         data = {}

From 49f3e9728c8031ee0b55187b2cc318b1964932c3 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Mar 25 2026 14:43:12 +0000
Subject: [PATCH 2/2] make a copy of data since we can modify it now


---

diff --git a/koji/policy.py b/koji/policy.py
index e79d682..757affc 100644
--- a/koji/policy.py
+++ b/koji/policy.py
@@ -514,7 +514,7 @@ class RuleChecker(object):
 
     def __init__(self, ruleset, data):
         self.ruleset = ruleset
-        self.data = data
+        self.data = data.copy()
         self.logger = logging.getLogger('koji.policy')
         self.lastrule = None
         self.lastaction = None