fix: reject array indices with a leading zero (RFC 6901)#331
Open
spokodev wants to merge 1 commit into
Open
Conversation
isInteger() only checked that every character is a digit, so it accepted
malformed array indices with a leading zero such as "01" or "007". Those
are not valid JSON Pointer array indices (RFC 6901 section 4: "0", or a
digit 1-9 followed by digits). As a result `add` (and move/copy
destinations) accepted them and coerced "01" to index 1, while
replace/remove/move-from rejected them, so under `validate: true`
validate() and applyOperation() disagreed about the same path depending
on the operation:
applyOperation([10,20,30], {op:'add', path:'/01', value:9}, true) // mutated at index 1
applyOperation([10,20,30], {op:'replace', path:'/01', value:9}, true) // threw
Reject a leading zero in isInteger so `/01` consistently raises
OPERATION_PATH_ILLEGAL_ARRAY_INDEX, matching that error's own definition
("an unsigned base-10 integer value"). "0" and ordinary indices are
unaffected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
isInteger()only checks that every character is a digit, so it accepts malformed array indices with a leading zero such as01or007. Those are not valid JSON Pointer array indices — RFC 6901 §4 defines an array index as"0", or a digit1-9followed by digits.Because of this,
add(andmove/copydestinations) accept/01and coerce it to index1, whilereplace/remove/move-from reject it. Undervalidate: true(the spec-safe mode)validate()andapplyOperation()therefore disagree about the same path depending on the operation:The library already intends to validate this — the dedicated error
OPERATION_PATH_ILLEGAL_ARRAY_INDEXis defined as "Expected an unsigned base-10 integer value…" and/+1is already rejected — so this is an incomplete check, not intended leniency.Fix
Reject a leading zero in
isInteger, so/01consistently raisesOPERATION_PATH_ILLEGAL_ARRAY_INDEX."0"and ordinary indices are unaffected.Test
Added a
validateassertion thatadd /01against an array is rejected withOPERATION_PATH_ILLEGAL_ARRAY_INDEX. It fails before the change and passes after. The full suite is green, including the standard json-patch-tests conformance suite (216 core specs, 83 duplex, 0 failures).