You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit c71171e
Browse filesBrowse the repository at this point in the historyBrowse files
committed
fix: panics in Pointer.Get, Pointer.Set and json name resolution
Get and Set panicked on several ordinary document shapes. All are reachable
from the public API with no privileges, so a consumer resolving pointers
against attacker-influenced JSON could be crashed.
Set with a nil value -- what encoding/json decodes a JSON null into -- called
reflect.Value.Type on the zero Value in the struct and slice branches:
reflect: call of reflect.Value.Type on zero Value
A nil value now resolves to the zero value of the target when the target can
hold nil, and reports an error wrapping ErrPointer when it cannot: a string
field has no representation of null, and substituting "" would erase the
difference.
The map branch of setSingleImpl had no guard at all. reflect.Value.SetMapIndex
panicked whenever the value was not assignable to the map value type, and
deleted the member outright when handed the zero Value, so setting a
map[string]any member to null silently removed it. The member is now kept with
a nil value, and a mismatched type reports an error instead of panicking.
jsonname.buildnameIndex recursed into anonymous fields without checking their
kind, so embedding *Base panicked while building the name index under the
default provider:
reflect: NumField of non-struct type *main.Base
The same panic hit the exported GetJSONNames for any non-struct subject.
Anonymous fields are now reduced with structTypeOf: a pointer is dereferenced,
and a field that is not a struct promotes nothing. newNameIndex and the three
entry points tolerate a nil or non-struct subject, and GoNameProvider gets the
same nil-subject guard.
Fixing that alone only moved the crash: a field promoted through a nil embedded
pointer then panicked in reflect.Value.FieldByName. The four call sites go
through fieldByName, which uses reflect.Value.FieldByIndexErr and reports
"cannot reach field".
Maps keyed by a non-string type panicked in MapIndex and SetMapIndex, on Get as
well as Set. Tokens are now converted against the map key type by mapKeyValue,
which also makes map[NamedStringType]V resolve instead of panicking.
A sweep of 4224 Get, Set, GetForToken and SetForToken calls over these shapes
panics 0 times. The same sweep panics 483 times on master.
The three copies of the nil-handling block are folded into resolveSetValue,
which also clears the gocognit (44 > 30) and nestif reports that the first
version of this branch introduced.
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>
0 commit comments