Unsafe variable in user-function but not in builtin function

[timothyhinrichs]

The safety rules are different for user functions and builtin functions, but there's no clear reason for them to be different. In particular, user functions cannot use iteration variables in arguments, but builtin functions can.

Below we see that z[_] is allowed as the first argument to builtin function concat, but it is not allowed as the first argument to the user function f.

> x = {y | z = ["a", "b", "c"]; concat(z[_], ["123", "456"], y)}
>

> f (x) = x { true }
> x = {y | z = ["a", "b", "c"]; f(z[_], y)}
1 error occurred: 1:1: rego_unsafe_var_error: var _ is unsafe

[tsandall]

There's a related issue in the safety check...

If a function input is unsafe, the output vars are added to the safe set regardless. This means the following query f(x, x) would be considered safe (and result in an error during evaluation.)