[BUG] Azure.ResourceManager.Network - error parsing WebApplicationFirewallPolicyResource #63556

Activity

1. github-actions

   assigned

   Arthur Ma (ArthurMa1978)

   on Oct 1, 2026
2. github-actions

   added

   Network - Application Gateway

   MgmtThis issue is related to a management-plane library.This issue is related to a management-plane library.

   customer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.

   questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as thatThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

   needs-team-attentionWorkflow: This issue needs attention from Azure service team or SDK teamWorkflow: This issue needs attention from Azure service team or SDK team

   on Oct 1, 2026
3. github-actions commented on Oct 1, 2026

   

   github-actionsbot

   on Oct 1, 2026 – with GitHub Actions

   More actions

   Thank you for your feedback. Tagging and routing to the team member(s) best able to assist.

   Generated by Agentic Triage for #63556 · copilot · auto · 52 AIC · ⌖ 18.4 AIC · ⊞ 16.6K · ◷
4. github-actions commented on Oct 1, 2026

   

   github-actionsbot

   on Oct 1, 2026 – with GitHub Actions

   More actions

   🎯 Agentic Issue Triage

   Summary: Deserializing a WebApplicationFirewallPolicyResource whose managed rule set includes computedDisabledRules with numeric rule IDs throws InvalidOperationException because the generated deserializer expects a JSON string but the service returns a number.

   📋 Issue Details

   Package: Azure.ResourceManager.Network 1.16+ (reproduced on 1.17.0)
   Affected API: ManagedRuleSetRuleGroup.DeserializeManagedRuleSetRuleGroup (via WebApplicationFirewallPolicyData.FromResponse / WebApplicationFirewallPolicyResource.GetAsync)
   Scenarios:

   • Calling GetWebApplicationFirewallPolicyResource(...).GetAsync() on a policy whose managedRules.managedRuleSets[].computedDisabledRules[].rules array contains numeric values (e.g. 800116) instead of strings.

   Root ask: The ARM response body should deserialize without throwing; numeric rule IDs in computedDisabledRules.rules should be accepted (as strings or converted) rather than causing a hard failure.

   🔎 Debugging / Reproduction Notes

   This appears to be a regression from the generator/AutoRest-to-TypeSpec migration in v1.16. The exact same root cause was previously reported and fixed in #51467 (NetworkExtensions.GetWebApplicationFirewallPolicies throwing JsonElementWrongTypeException for the same rules property), suggesting the prior fix (likely a lenient string/number read, e.g. via GetString() fallback or JsonElement.ToString()) was lost during the TypeSpec-based regeneration.

   Suggested investigation steps:

   1. Compare the pre-1.16 (AutoRest-generated) deserialization logic for ManagedRuleSetRuleGroup/rules against the current TypeSpec-generated code to confirm the lenient numeric-to-string handling was dropped.
   2. Check the TypeSpec definition/customization for ManagedRuleSetRuleGroup.Rules and adjust the type or add a customized reader that tolerates both JSON string and number tokens (mirroring the fix applied for [BUG] Azure.ResourceManager.Network.NetworkExtensions.GetWebApplicationFirewallPolicies throws JsonElementWrongTypeException #51467).
   3. Add a regression test using a payload with numeric values in computedDisabledRules[].rules to prevent this from recurring in future regenerations.

   🏷️ Label Confidence

   • Category: Mgmt — Issue is about Azure.ResourceManager.Network, a management-plane library.
   • Service: Network - Application Gateway — The WAF policy / managed rule sets are part of Application Gateway; this exactly matches the service label used on the prior identical-bug issue ([BUG] Azure.ResourceManager.Network.NetworkExtensions.GetWebApplicationFirewallPolicies throws JsonElementWrongTypeException #51467).
   • Confidence: High — The issue explicitly names the package/path, references a prior fixed issue with identical symptoms and stack trace shape, and a high-quality reference issue ([BUG] Azure.ResourceManager.Network.NetworkExtensions.GetWebApplicationFirewallPolicies throws JsonElementWrongTypeException #51467: exactly 1 category + 1 service label, customer-reported + issue-addressed present) confirms this exact label pairing.

   👥 Owner Routing

   • Matched CODEOWNERS entry: # ServiceLabel: %Mgmt (line 636) — No more specific entry for Network - Application Gateway exists in CODEOWNERS, so the general %Mgmt catch-all applies.
   • AzureSdkOwners: @ArthurMa1978
   • ServiceOwners: none listed
   • Routing action: Assigned @ArthurMa1978; added needs-team-attention since the reporter is an external customer.
   • Scan notes: Scanned bottom-to-top through the CODEOWNERS Mgmt section; no entry specifically for "Network - Application Gateway" or "Network" + "Mgmt" was found, only the general %Mgmt catch-all.

   Generated by Agentic Triage for #63556 · copilot · auto · 52 AIC · ⌖ 18.4 AIC · ⊞ 16.6K · ◷
5. github-actions commented on Oct 1, 2026

   

   github-actionsbot

   on Oct 1, 2026 – with GitHub Actions

   More actions

   🔍 Agentic Issue Investigation

   Outcome

   Recommended for Copilot automated fix

   Summary

   ManagedRuleSetRuleGroup.DeserializeManagedRuleSetRuleGroup calls item.GetString() on each element of the rules array, which throws InvalidOperationException when the service returns numeric rule IDs (as it does for computedDisabledRules). This is the same bug previously fixed in #51467 / PR #51573, but the fix appears to have been lost when the library migrated from AutoRest to TypeSpec generation.

   🩹 Mitigation

   No SDK-level workaround is available, since the exception occurs during deserialization of the GET response before the model is returned to caller code. As a temporary mitigation, customers can call the raw REST pipeline directly (bypassing the strongly-typed WebApplicationFirewallPolicyResource.GetAsync) and parse the JSON manually with System.Text.Json, converting numeric rules entries to strings before further processing.

   🧭 Root Cause

   In sdk/network/Azure.ResourceManager.Network/src/Generated/Models/ManagedRuleSetRuleGroup.Serialization.cs, DeserializeManagedRuleSetRuleGroup reads the rules array via array.Add(item.GetString()), which throws when the underlying JSON token is a Number rather than a String. The reporter's response body shows computedDisabledRules[].rules containing numeric values (e.g. 800116), confirming this path is hit. This matches the exact pattern fixed previously in PR #51573 for the same model, but since this file is now fully generated code (migrated to TypeSpec per CHANGELOG 1.16.0), that customization was not carried forward. The current generated code (verified in the latest source on main, versions through 1.18.0-beta.2/1.17.0 stable) still has the unguarded GetString() call, so this is confirmed present in current code.

   🛠️ Suggested Fix

   Because this file is fully generated, the fix must be applied via a customization (partial class override of DeserializeManagedRuleSetRuleGroup, following the pattern used for PR #51573) rather than editing the generated file directly, so it survives regeneration. The deserialization should accept both JsonValueKind.String and JsonValueKind.Number for each rules array element, converting numbers to their string representation (e.g. via item.ToString() or GetRawText()), consistent with the original 2025 fix. A regression test should exercise a WAF policy response containing numeric values in managedRuleSets[].computedDisabledRules[].rules and verify deserialization succeeds without exception.

   ✅ Decision Basis

   • Version currency: Confirmed present in current main branch generated code (latest stable 1.17.0 / prerelease 1.18.0-beta.2), so no "reproduce on latest" step is needed.
   • Duplicate: No open duplicate; [BUG] Azure.ResourceManager.Network.NetworkExtensions.GetWebApplicationFirewallPolicies throws JsonElementWrongTypeException #51467 is the closed precedent issue with an already-merged fix pattern (PR [Network] Fix for issue #51467 #51573) that can guide the new customization.
   • Ownership: SDK-side, confirmed by source inspection of the generated serialization file.
   • Scope: Bounded, testable change — a single deserialization customization plus a unit test, consistent with the exclusion list (no public API/breaking changes, no service-side dependency).

   A maintainer can assign Copilot to proceed. Automated assignment is best effort on this repository and may not complete.

   Generated by Agentic Issue Investigation · copilot · auto · 39.5 AIC · ⌖ 11.2 AIC · ⊞ 13.8K · ◷
6. Minghao Chen (HarveyLink)

   assigned

   Minghao Chen (HarveyLink)

   and unassigned

   Arthur Ma (ArthurMa1978)

   on Oct 15, 2026