zizmor 1.8.0rc1__tar.gz → 1.9.0__tar.gz

{zizmor-1.8.0rc1 → zizmor-1.9.0}/Cargo.lock

@@ -325,9 +325,9 @@ dependencies = [
 
 [[package]]
 name = "clap-verbosity-flag"
-version = "3.0.2"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2678fade3b77aa3a8ff3aae87e9c008d3fb00473a41c71fbf74e91c8c7b37e84"
+checksum = "eeab6a5cdfc795a05538422012f20a5496f050223c91be4e5420bfd13c641fb1"
 dependencies = [
  "clap",
  "tracing-core",
@@ -354,6 +354,16 @@ dependencies = [
  "clap",
 ]
 
+[[package]]
+name = "clap_complete_nushell"
+version = "4.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6a8b1593457dfc2fe539002b795710d022dc62a65bf15023f039f9760c7b18a"
+dependencies = [
+ "clap",
+ "clap_complete",
+]
+
 [[package]]
 name = "clap_derive"
 version = "4.5.32"
@@ -444,6 +454,27 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "csv"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
+dependencies = [
+ "csv-core",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d02f3b0da4c6504f86e9cd789d8dbafab48c2321be74e9987593de5a894d93d"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "deranged"
 version = "0.4.0"
@@ -615,6 +646,12 @@ dependencies = [
  "num",
 ]
 
+[[package]]
+name = "fst"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ab85b9b05e3978cc9a9cf8fea7f01b494e1a09ed3037e16ba39edc7a29eb61a"
+
 [[package]]
 name = "futures"
 version = "0.3.31"
@@ -749,7 +786,7 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
 name = "github-actions-expressions"
-version = "0.0.3"
+version = "0.0.4"
 dependencies = [
  "anyhow",
  "itertools",
@@ -760,7 +797,7 @@ dependencies = [
 
 [[package]]
 name = "github-actions-models"
-version = "0.28.3"
+version = "0.29.0"
 dependencies = [
  "indexmap",
  "serde",
@@ -2569,9 +2606,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.45.0"
+version = "1.45.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
+checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2797,9 +2834,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter-yaml"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0c99f2b92b677f1a18b6b232fa9329afb5758118238a7d0b29cae324ef50d5e"
+checksum = "3d5893f2a05e57c86a2338aa3aed167a1e5c68b8fdff3bf4a460941f2d8fc944"
 dependencies = [
  "cc",
  "tree-sitter-language",
@@ -3464,7 +3501,7 @@ checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
 
 [[package]]
 name = "yamlpath"
-version = "0.18.0"
+version = "0.19.0"
 dependencies = [
  "serde",
  "serde_yaml",
@@ -3594,7 +3631,7 @@ dependencies = [
 
 [[package]]
 name = "zizmor"
-version = "1.8.0-rc1"
+version = "1.9.0"
 dependencies = [
  "annotate-snippets",
  "anstream",
@@ -3604,8 +3641,11 @@ dependencies = [
  "clap",
  "clap-verbosity-flag",
  "clap_complete",
+ "clap_complete_nushell",
+ "csv",
  "etcetera",
  "flate2",
+ "fst",
  "github-actions-expressions",
  "github-actions-models",
  "http-cache-reqwest",

{zizmor-1.8.0rc1 → zizmor-1.9.0}/Cargo.toml

@@ -11,8 +11,8 @@ license = "MIT"
 
 [workspace.dependencies]
 anyhow = "1.0.98"
-github-actions-expressions = { path = "crates/github-actions-expressions", version = "0.0.3" }
-github-actions-models = { path = "crates/github-actions-models", version = "0.28.3" }
+github-actions-expressions = { path = "crates/github-actions-expressions", version = "0.0.4" }
+github-actions-models = { path = "crates/github-actions-models", version = "0.29.0" }
 itertools = "0.14.0"
 pest = "2.8.0"
 pest_derive = "2.8.0"
@@ -22,10 +22,13 @@ anstream = "0.6.18"
 assert_cmd = "2.0.17"
 camino = "1.1.9"
 clap = "4.5.38"
-clap-verbosity-flag = { version = "3.0.2", default-features = false }
+clap-verbosity-flag = { version = "3.0.3", default-features = false }
 clap_complete = "4.5.50"
+clap_complete_nushell = "4.5.5"
+csv = "1.3.1"
 etcetera = "0.10.0"
 flate2 = "1.1.1"
+fst = "0.4.7"
 http-cache-reqwest = "0.15.1"
 human-panic = "2.0.1"
 ignore = "0.4.23"
@@ -46,15 +49,15 @@ serde_yaml = "0.9.34"
 tar = "0.4.44"
 terminal-link = "0.1.0"
 thiserror = "2.0.12"
-tokio = "1.45.0"
+tokio = "1.45.1"
 tracing = "0.1.41"
 tracing-indicatif = "0.3.9"
 tracing-subscriber = "0.3.19"
 tree-sitter = "0.25.4"
 tree-sitter-bash = "0.23.3"
 tree-sitter-powershell = "0.25.2"
-yamlpath = { path = "crates/yamlpath", version = "0.18.0" }
-tree-sitter-yaml = "0.7.0"
+yamlpath = { path = "crates/yamlpath", version = "0.19.0" }
+tree-sitter-yaml = "0.7.1"
 
 
 [profile.dev.package]

{zizmor-1.8.0rc1 → zizmor-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zizmor
-Version: 1.8.0rc1
+Version: 1.9.0
 License-File: LICENSE
 Summary: Static analysis for GitHub Actions
 Keywords: cli,github-actions,static-analysis,security
@@ -66,7 +66,8 @@ See [our contributing guide!](./CONTRIBUTING.md)
 `zizmor`'s development is supported by these amazing sponsors!
 
 <!-- @@begin-sponsors@@ -->
-<table>
+<table width="100%">
+<caption>Logo-level sponsors</caption>
 <tbody>
 <tr>
 <td align="center" valign="top" width="15%">
@@ -79,6 +80,19 @@ Astral
 </tr>
 </tbody>
 </table>
+<hr align="center">
+<table width="100%">
+<caption>Name-level sponsors</caption>
+<tbody>
+<tr>
+<td align="center" valign="top">
+<a href="http://tenki.cloud/">
+Tenki Cloud
+</a>
+</td>
+</tr>
+</tbody>
+</table>
 <!-- @@end-sponsors@@ -->
 
 ## Star History

{zizmor-1.8.0rc1 → zizmor-1.9.0}/crates/github-actions-expressions/Cargo.toml

@@ -2,7 +2,7 @@
 name = "github-actions-expressions"
 description = "GitHub Actions expression parser and data types"
 repository = "https://github.com/zizmorcore/zizmor/tree/main/crates/github-actions-expressions"
-version = "0.0.3"
+version = "0.0.4"
 readme = "README.md"
 
 homepage.workspace = true

{zizmor-1.8.0rc1 → zizmor-1.9.0}/crates/github-actions-expressions/src/context.rs

@@ -1,5 +1,6 @@
 //! Parsing and matching APIs for GitHub Actions expressions
 //! contexts (e.g. `github.event.name`).
+
 use super::Expr;
 
 /// Represents a context in a GitHub Actions expression.
@@ -47,6 +48,54 @@ impl<'src> Context<'src> {
             _ => None,
         }
     }
+
+    /// Returns the "pattern equivalent" of this context.
+    ///
+    /// This is a string that can be used to efficiently match the context,
+    /// such as is done in `zizmor`'s template-injection audit via a
+    /// finite state transducer.
+    ///
+    /// Returns None if the context doesn't have a sensible pattern
+    /// equivalent, e.g. if it starts with a call.
+    pub fn as_pattern(&self) -> Option<String> {
+        fn push_part(part: &Expr<'_>, pattern: &mut String) {
+            match part {
+                Expr::Identifier(ident) => pattern.push_str(ident.0),
+                Expr::Star => pattern.push('*'),
+                Expr::Index(idx) => match idx.as_ref() {
+                    // foo['bar'] -> foo.bar
+                    Expr::String(idx) => pattern.push_str(idx),
+                    // any kind of numeric or computed index, e.g.:
+                    // foo[0], foo[1 + 2], foo[bar]
+                    _ => pattern.push('*'),
+                },
+                _ => unreachable!("unexpected part in context pattern"),
+            }
+        }
+
+        // TODO: Optimization ideas:
+        // 1. Add a happy path for contexts that contain only
+        //    identifiers? Problem: case normalization.
+        // 2. Use `regex-automata` to return a case insensitive
+        //    automation here?
+        let mut pattern = String::with_capacity(self.raw.len());
+
+        let mut parts = self.parts.iter().peekable();
+
+        let head = parts.next()?;
+        if matches!(head, Expr::Call { .. }) {
+            return None;
+        }
+
+        push_part(head, &mut pattern);
+        for part in parts {
+            pattern.push('.');
+            push_part(part, &mut pattern);
+        }
+
+        pattern.make_ascii_lowercase();
+        Some(pattern)
+    }
 }
 
 impl PartialEq for Context<'_> {
@@ -120,33 +169,28 @@ impl<'src> ContextPattern<'src> {
         }
     }
 
+    fn compare_part(pattern: &str, part: &Expr<'src>) -> bool {
+        if pattern == "*" {
+            true
+        } else {
+            match part {
+                Expr::Identifier(part) => pattern.eq_ignore_ascii_case(part.0),
+                Expr::Index(part) => match part.as_ref() {
+                    Expr::String(part) => pattern.eq_ignore_ascii_case(part),
+                    _ => false,
+                },
+                _ => false,
+            }
+        }
+    }
+
     fn compare(&self, ctx: &Context<'src>) -> Option<Comparison> {
         let mut pattern_parts = self.0.split('.').peekable();
         let mut ctx_parts = ctx.parts.iter().peekable();
 
         while let (Some(pattern), Some(part)) = (pattern_parts.peek(), ctx_parts.peek()) {
-            // TODO: Refactor this; it's way too hard to read.
-            match (*pattern, part) {
-                // Calls can't be compared to patterns.
-                (_, Expr::Call { .. }) => return None,
-                // "*" matches any part.
-                ("*", _) => {}
-                (_, Expr::Star) => return None,
-                (pattern, Expr::Identifier(part)) if !pattern.eq_ignore_ascii_case(part.0) => {
-                    return None;
-                }
-                (pattern, Expr::Index(idx)) => {
-                    // Anything other than a string index is invalid
-                    // for part-wise comparison.
-                    let Expr::String(part) = idx.as_ref() else {
-                        return None;
-                    };
-
-                    if !pattern.eq_ignore_ascii_case(part) {
-                        return None;
-                    }
-                }
-                _ => {}
+            if !Self::compare_part(pattern, part) {
+                return None;
             }
 
             pattern_parts.next();
@@ -253,6 +297,45 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_context_as_pattern() {
+        for (case, expected) in &[
+            // Basic cases.
+            ("foo", Some("foo")),
+            ("foo.bar", Some("foo.bar")),
+            ("foo.bar.baz", Some("foo.bar.baz")),
+            ("foo.bar.baz_baz", Some("foo.bar.baz_baz")),
+            ("foo.bar.baz-baz", Some("foo.bar.baz-baz")),
+            ("foo.*", Some("foo.*")),
+            ("foo.bar.*", Some("foo.bar.*")),
+            ("foo.*.baz", Some("foo.*.baz")),
+            ("foo.*.*", Some("foo.*.*")),
+            // Case sensitivity.
+            ("FOO", Some("foo")),
+            ("FOO.BAR", Some("foo.bar")),
+            ("FOO.BAR.BAZ", Some("foo.bar.baz")),
+            ("FOO.BAR.BAZ_BAZ", Some("foo.bar.baz_baz")),
+            ("FOO.BAR.BAZ-BAZ", Some("foo.bar.baz-baz")),
+            ("FOO.*", Some("foo.*")),
+            ("FOO.BAR.*", Some("foo.bar.*")),
+            ("FOO.*.BAZ", Some("foo.*.baz")),
+            ("FOO.*.*", Some("foo.*.*")),
+            // Indexes.
+            ("foo.bar.baz[0]", Some("foo.bar.baz.*")),
+            ("foo.bar.baz['abc']", Some("foo.bar.baz.abc")),
+            ("foo.bar.baz[0].qux", Some("foo.bar.baz.*.qux")),
+            ("foo.bar.baz[0].qux[1]", Some("foo.bar.baz.*.qux.*")),
+            ("foo[1][2][3]", Some("foo.*.*.*")),
+            ("foo.bar[abc]", Some("foo.bar.*")),
+            ("foo.bar[abc()]", Some("foo.bar.*")),
+            // Invalid cases
+            ("foo().bar", None),
+        ] {
+            let ctx = Context::try_from(*case).unwrap();
+            assert_eq!(ctx.as_pattern().as_deref(), *expected);
+        }
+    }
+
     #[test]
     fn test_contextpattern_new() {
         for (case, expected) in &[

{zizmor-1.8.0rc1 → zizmor-1.9.0}/crates/github-actions-expressions/src/lib.rs

@@ -28,7 +28,7 @@ mod parser {
 ///
 /// Function names are case-insensitive.
 #[derive(Debug)]
-pub struct Function<'src>(&'src str);
+pub struct Function<'src>(pub(crate) &'src str);
 
 impl PartialEq for Function<'_> {
     fn eq(&self, other: &Self) -> bool {
@@ -455,7 +455,7 @@ mod tests {
     use pest::Parser as _;
     use pretty_assertions::assert_eq;
 
-    use super::{BinOp, Context, Expr, ExprParser, Function, Rule, UnOp};
+    use super::{BinOp, Expr, ExprParser, Function, Rule, UnOp};
 
     #[test]
     fn test_function_eq() {
@@ -467,58 +467,6 @@ mod tests {
         assert_eq!(func, Function("FOO"));
     }
 
-    #[test]
-    fn test_context_eq() {
-        let ctx = Context::try_from("foo.bar.baz").unwrap();
-        assert_eq!(&ctx, "foo.bar.baz");
-        assert_eq!(&ctx, "FOO.BAR.BAZ");
-        assert_eq!(&ctx, "Foo.Bar.Baz");
-    }
-
-    #[test]
-    fn test_context_child_of() {
-        let ctx = Context::try_from("foo.bar.baz").unwrap();
-
-        for (case, child) in &[
-            // Trivial child cases.
-            ("foo", true),
-            ("foo.bar", true),
-            // Case-insensitive cases.
-            ("FOO", true),
-            ("FOO.BAR", true),
-            ("Foo", true),
-            ("Foo.Bar", true),
-            // We consider a context to be a child of itself.
-            ("foo.bar.baz", true),
-            // Trivial non-child cases.
-            ("foo.bar.baz.qux", false),
-            ("foo.bar.qux", false),
-            ("foo.qux", false),
-            ("qux", false),
-            // Invalid cases.
-            ("foo.", false),
-            (".", false),
-            ("", false),
-        ] {
-            assert_eq!(ctx.child_of(*case), *child);
-        }
-    }
-
-    #[test]
-    fn test_context_pop_if() {
-        let ctx = Context::try_from("foo.bar.baz").unwrap();
-
-        for (case, expected) in &[
-            ("foo", Some("bar.baz")),
-            ("Foo", Some("bar.baz")),
-            ("FOO", Some("bar.baz")),
-            ("foo.", None),
-            ("bar", None),
-        ] {
-            assert_eq!(ctx.pop_if(case), *expected);
-        }
-    }
-
     #[test]
     fn test_parse_string_rule() {
         let cases = &[

{zizmor-1.8.0rc1 → zizmor-1.9.0}/crates/github-actions-models/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "github-actions-models"
-version = "0.28.3"
+version = "0.29.0"
 description = "Unofficial, high-quality data models for GitHub Actions workflows, actions, and related components"
 repository = "https://github.com/zizmorcore/zizmor/tree/main/crates/github-actions-models"
 keywords = ["github", "ci"]

{zizmor-1.8.0rc1 → zizmor-1.9.0}/crates/github-actions-models/src/common.rs

@@ -88,6 +88,22 @@ impl Display for EnvValue {
     }
 }
 
+impl EnvValue {
+    /// Returns whether this [`EnvValue`] is a "trueish" value
+    /// per C#'s `Boolean.TryParse`.
+    ///
+    /// This follows the semantics of C#'s `Boolean.TryParse`, where
+    /// the case-insensitive string "true" is considered true, but
+    /// "1", "yes", etc. are not.
+    pub fn csharp_trueish(&self) -> bool {
+        match self {
+            EnvValue::Boolean(true) => true,
+            EnvValue::String(maybe) => maybe.trim().eq_ignore_ascii_case("true"),
+            _ => false,
+        }
+    }
+}
+
 /// A "scalar or vector" type, for places in GitHub Actions where a
 /// key can have either a scalar value or an array of values.
 ///
@@ -405,6 +421,31 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_env_value_csharp_trueish() {
+        let vectors = [
+            (EnvValue::Boolean(true), true),
+            (EnvValue::Boolean(false), false),
+            (EnvValue::String("true".to_string()), true),
+            (EnvValue::String("TRUE".to_string()), true),
+            (EnvValue::String("TrUe".to_string()), true),
+            (EnvValue::String(" true ".to_string()), true),
+            (EnvValue::String("   \n\r\t True\n\n".to_string()), true),
+            (EnvValue::String("false".to_string()), false),
+            (EnvValue::String("1".to_string()), false),
+            (EnvValue::String("yes".to_string()), false),
+            (EnvValue::String("on".to_string()), false),
+            (EnvValue::String("random".to_string()), false),
+            (EnvValue::Number(1.0), false),
+            (EnvValue::Number(0.0), false),
+            (EnvValue::Number(666.0), false),
+        ];
+
+        for (val, expected) in vectors {
+            assert_eq!(val.csharp_trueish(), expected, "failed for {:?}", val);
+        }
+    }
+
     #[test]
     fn test_uses_parses() {
         let vectors = [

{zizmor-1.8.0rc1 → zizmor-1.9.0}/crates/yamlpath/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "yamlpath"
-version = "0.18.0"
+version = "0.19.0"
 description = "Format-preserving YAML feature extraction"
 repository = "https://github.com/zizmorcore/zizmor/tree/main/crates/yamlpath"
 readme = "README.md"

{zizmor-1.8.0rc1 → zizmor-1.9.0}/crates/yamlpath/src/lib.rs

@@ -70,16 +70,16 @@ pub enum QueryError {
 /// The sub-list member `e` would be identified via the path
 /// `foo`, `bar`, `baz`, `1`, `1`.
 #[derive(Debug)]
-pub struct Query {
+pub struct Query<'a> {
     /// The individual top-down components of this query.
-    route: Vec<Component>,
+    route: Vec<Component<'a>>,
 }
 
-impl Query {
+impl<'a> Query<'a> {
     /// Constructs a new query from the given path components.
     ///
     /// Returns `None` if the component list is empty.
-    pub fn new(route: Vec<Component>) -> Option<Self> {
+    pub fn new(route: Vec<Component<'a>>) -> Option<Self> {
         if route.is_empty() {
             None
         } else {
@@ -98,32 +98,32 @@ impl Query {
 
 /// A builder for [`Query`] objects.
 #[derive(Clone, Debug)]
-pub struct QueryBuilder {
-    route: Vec<Component>,
+pub struct QueryBuilder<'a> {
+    route: Vec<Component<'a>>,
 }
 
-impl Default for QueryBuilder {
+impl Default for QueryBuilder<'_> {
     fn default() -> Self {
         Self::new()
     }
 }
 
-impl QueryBuilder {
+impl<'a> QueryBuilder<'a> {
     /// Starts a new `QueryBuilder`.
     pub fn new() -> Self {
         Self { route: vec![] }
     }
 
     /// Adds a new key to the query being built.
-    pub fn key(mut self, key: impl Into<String>) -> Self {
-        self.route.push(Component::Key(key.into()));
+    pub fn key(mut self, key: &'a str) -> Self {
+        self.route.push(Component::Key(key));
         self
     }
 
     /// Adds multiple new keys to the query being built.
-    pub fn keys(mut self, keys: impl Iterator<Item = impl Into<String>>) -> Self {
+    pub fn keys(mut self, keys: impl Iterator<Item = &'a str>) -> Self {
         for key in keys {
-            self = self.key(key.into())
+            self = self.key(key)
         }
 
         self
@@ -139,16 +139,16 @@ impl QueryBuilder {
     /// it in the process.
     ///
     /// Panics unless at least one component has been added.
-    pub fn build(self) -> Query {
+    pub fn build(self) -> Query<'a> {
         Query::new(self.route).expect("API misuse: must add at least one component")
     }
 }
 
 /// A single `Query` component.
 #[derive(Clone, Debug, PartialEq)]
-pub enum Component {
+pub enum Component<'a> {
     /// A YAML key.
-    Key(String),
+    Key(&'a str),
 
     /// An index into a YAML array.
     Index(usize),
@@ -473,7 +473,7 @@ impl Document {
         {
             match component {
                 Component::Index(idx) => self.descend_sequence(&child, *idx),
-                Component::Key(key) => Err(QueryError::ExpectedMapping(key.into())),
+                Component::Key(key) => Err(QueryError::ExpectedMapping(key.to_string())),
             }
         } else {
             Err(QueryError::UnexpectedNode(child.kind().into()))
@@ -579,7 +579,7 @@ mod tests {
             .build();
         assert_eq!(
             query.parent().unwrap().route,
-            [Component::Key("foo".into()), Component::Key("bar".into())]
+            [Component::Key("foo"), Component::Key("bar")]
         );
 
         let query = QueryBuilder::new().keys(["foo"].into_iter()).build();
@@ -634,11 +634,11 @@ baz: quux
         assert_eq!(
             query.route,
             [
-                Component::Key("foo".into()),
-                Component::Key("bar".into()),
+                Component::Key("foo"),
+                Component::Key("bar"),
                 Component::Index(1),
                 Component::Index(123),
-                Component::Key("lol".into()),
+                Component::Key("lol"),
             ]
         )
     }
@@ -659,10 +659,10 @@ baz:
         let doc = Document::new(doc).unwrap();
         let query = Query {
             route: vec![
-                Component::Key("baz".into()),
-                Component::Key("sub".into()),
-                Component::Key("keys".into()),
-                Component::Key("abc".into()),
+                Component::Key("baz"),
+                Component::Key("sub"),
+                Component::Key("keys"),
+                Component::Key("abc"),
                 Component::Index(2),
                 Component::Index(3),
             ],
@@ -692,7 +692,7 @@ bar: # outside
 
         // Querying the root gives us all comments underneath it.
         let query = Query {
-            route: vec![Component::Key("root".into())],
+            route: vec![Component::Key("root")],
         };
         let feature = doc.query(&query).unwrap();
         assert_eq!(
@@ -704,8 +704,8 @@ bar: # outside
         // even though it's above it on the AST.
         let query = Query {
             route: vec![
-                Component::Key("root".into()),
-                Component::Key("e".into()),
+                Component::Key("root"),
+                Component::Key("e"),
                 Component::Index(1),
             ],
         };