Skip to content

Reject invalid escape sequences in JSON Pointer paths - #147

Open
vitalivo wants to merge 1 commit into
Jeffail:masterfrom
vitalivo:fix/json-pointer-escapes
Open

vitalivo wants to merge 1 commit into
Jeffail:masterfrom
vitalivo:fix/json-pointer-escapes

Conversation

@vitalivo

Copy link
Copy Markdown

This replaces #146, which was accidentally closed and its source fork deleted. The implementation is unchanged; the original discussion and reviews remain linked there.


JSONPointerToSlice accepts bare tildes and escapes such as ~2, so SetJSONPointer("value", "/~2") silently creates a key instead of returning a syntax error. RFC 6901 section 3 permits only ~0 and ~1 escape sequences.

Validate each encoded token before applying the existing replacements. Tests cover five invalid paths, verify that invalid writes leave the document unchanged, and retain valid escapes including ~01 (which must decode to ~1, not /).

Validation: all five invalid-path cases fail before the fix. go test -race -cover ./... passes (87.4% coverage), as do the CI-style go test -count 100 ./..., go vet ./..., and staticcheck.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant