Default fn validator context will be not strict type checking (#3386)

* Default fn validator context will be not strict type checking

* Update getatt testing as well

Author: kddejong

src/cfnlint/helpers.py

@@ -564,7 +564,9 @@ def _translate_types(types: Sequence[str]) -> list[str]:
 
 
 def is_types_compatible(
-    source_types: str | Sequence[str], destination_types: str | Sequence[str]
+    source_types: str | Sequence[str],
+    destination_types: str | Sequence[str],
+    strict_types: bool = False,
 ) -> bool:
     """
     Validate if desination types are compatible with source types.
@@ -576,7 +578,8 @@ def is_types_compatible(
     Returns:
         bool: If any type of source is compatible with any type in the destination
     """
-    source_types = _translate_types(ensure_list(source_types))
+    if not strict_types:
+        source_types = _translate_types(ensure_list(source_types))
     destination_types = ensure_list(destination_types)
 
     if any(schema_type in source_types for schema_type in destination_types):

src/cfnlint/jsonschema/_keywords_cfn.py

@@ -59,7 +59,8 @@ def validate(
             for (index, item), subschema in zip(enumerate(instance), s):
                 yield from validator.evolve(
                     context=validator.context.evolve(
-                        functions=subschema.get("functions", [])
+                        functions=subschema.get("functions", []),
+                        strict_types=False,
                     ),
                 ).descend(
                     instance=item,
@@ -69,7 +70,10 @@ def validate(
         else:
             for index, item in enumerate(instance):
                 yield from validator.evolve(
-                    context=validator.context.evolve(functions=s.get("functions", [])),
+                    context=validator.context.evolve(
+                        functions=s.get("functions", []),
+                        strict_types=False,
+                    ),
                 ).descend(
                     instance=item,
                     schema=s.get("schema", {}),

src/cfnlint/rules/functions/GetAtt.py

@@ -132,7 +132,9 @@ def _resolve_getatt(
 
                         types = ensure_list(s.get("type"))
 
-                        if is_types_compatible(types, schema_types):
+                        if is_types_compatible(
+                            types, schema_types, validator.context.strict_types
+                        ):
                             continue
 
                         reprs = ", ".join(repr(type) for type in types)

src/cfnlint/rules/functions/Sub.py

@@ -90,6 +90,7 @@ def _validate_string(
                 path=validator.context.path.descend(
                     path=key,
                 ),
+                strict_types=True,
             ),
             function_filter=validator.function_filter.evolve(
                 add_cfn_lint_keyword=False,

test/unit/module/jsonschema/test_keywords_cfn.py

@@ -8,7 +8,7 @@
 from typing import List
 
 from cfnlint.context import Context
-from cfnlint.jsonschema._keywords_cfn import cfn_type
+from cfnlint.jsonschema._keywords_cfn import FnItems, cfn_type
 from cfnlint.jsonschema.exceptions import UnknownType
 from cfnlint.jsonschema.validators import CfnTemplateValidator
 
@@ -136,3 +136,18 @@ def test_cfn_type_failure(self):
         self.assertIn(
             "Unknown type 'bar' for validator with schema", str(err.exception)
         )
+
+
+class TestFnItems(Base):
+
+    def test_change_type(self):
+        schema = [
+            {
+                "schema": {"type": "string"},
+            },
+        ]
+        validator = CfnTemplateValidator({})
+
+        items = list(FnItems().validate(validator, schema, [1], {}))
+
+        self.assertListEqual(items, [])

test/unit/rules/functions/test_getatt.py

@@ -158,10 +158,32 @@ def validate(self, validator, s, instance, schema):
             "Valid GetAtt with integer to string",
             {"Fn::GetAtt": "MyCodePipeline.Version"},
             {"type": ["integer"]},
-            {},
+            {
+                "strict_types": False,
+            },
             {},
             [],
         ),
+        (
+            "Invalid GetAtt with integer to string",
+            {"Fn::GetAtt": "MyCodePipeline.Version"},
+            {"type": ["integer"]},
+            {
+                "strict_types": True,
+            },
+            {},
+            [
+                ValidationError(
+                    (
+                        "{'Fn::GetAtt': 'MyCodePipeline.Version'} "
+                        "is not of type 'integer'"
+                    ),
+                    path=deque(["Fn::GetAtt"]),
+                    schema_path=deque(["type"]),
+                    validator="fn_getatt",
+                )
+            ],
+        ),
         (
             "Valid GetAtt with one good response type",
             {"Fn::GetAtt": "MyBucket.Arn"},
@@ -244,4 +266,9 @@ def test_validate(
     rule.child_rules = child_rules
     validator = CfnTemplateValidator({}, context=context, cfn=cfn)
     errs = list(rule.fn_getatt(validator, schema, instance, {}))
+
+    for err in errs:
+        print(err.validator)
+        print(err.path)
+        print(err.schema_path)
     assert errs == expected, f"Test {name!r} got {errs!r}"

test/unit/rules/functions/test_sub.py

@@ -29,6 +29,7 @@ def cfn():
             "Resources": {
                 "MyResource": {"Type": "AWS::S3::Bucket"},
                 "MySimpleAd": {"Type": "AWS::DirectoryService::SimpleAD"},
+                "MyPolicy": {"Type": "AWS::IAM::ManagedPolicy"},
             },
         },
         regions=["us-east-1"],
@@ -95,7 +96,7 @@ def context(cfn):
                 ValidationError(
                     (
                         "'bar' is not one of ["
-                        "'MyResource', 'MySimpleAd', 'AWS::AccountId', "
+                        "'MyResource', 'MySimpleAd', 'MyPolicy', 'AWS::AccountId', "
                         "'AWS::NoValue', 'AWS::NotificationARNs', "
                         "'AWS::Partition', 'AWS::Region', "
                         "'AWS::StackId', 'AWS::StackName', 'AWS::URLSuffix']"
@@ -114,7 +115,7 @@ def context(cfn):
                 ValidationError(
                     (
                         "'foo' is not one of ["
-                        "'MyResource', 'MySimpleAd', 'AWS::AccountId', "
+                        "'MyResource', 'MySimpleAd', 'MyPolicy', 'AWS::AccountId', "
                         "'AWS::NoValue', 'AWS::NotificationARNs', "
                         "'AWS::Partition', 'AWS::Region', "
                         "'AWS::StackId', 'AWS::StackName', 'AWS::URLSuffix']"
@@ -228,7 +229,7 @@ def context(cfn):
             {"type": "string"},
             [
                 ValidationError(
-                    "'Foo' is not one of ['MyResource', 'MySimpleAd']",
+                    "'Foo' is not one of ['MyResource', 'MySimpleAd', 'MyPolicy']",
                     path=deque(["Fn::Sub"]),
                     schema_path=deque([]),
                     validator="fn_sub",
@@ -241,7 +242,21 @@ def context(cfn):
             {"type": "string"},
             [
                 ValidationError(
-                    ("'MySimpleAd.DnsIpAddresses' is not " "of type 'string'"),
+                    ("'MySimpleAd.DnsIpAddresses' is not of type 'string'"),
+                    instance="MySimpleAd.DnsIpAddresses",
+                    path=deque(["Fn::Sub"]),
+                    schema_path=deque([]),
+                    validator="fn_sub",
+                ),
+            ],
+        ),
+        (
+            "Invalid Fn::Sub with a GetAtt to an integer",
+            {"Fn::Sub": "${MyPolicy.AttachmentCount}"},
+            {"type": "string"},
+            [
+                ValidationError(
+                    ("'MyPolicy.AttachmentCount' is not of type 'string'"),
                     instance="MySimpleAd.DnsIpAddresses",
                     path=deque(["Fn::Sub"]),
                     schema_path=deque([]),