From fb0e60aabb24dfdd52275670f83733ef8b6c1af9 Mon Sep 17 00:00:00 2001 From: Oskar Eichler Date: Sun, 30 Aug 2026 00:12:25 +0200 Subject: [PATCH] Validate expression separators --- lib/jmespath/parser.rb | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/lib/jmespath/parser.rb b/lib/jmespath/parser.rb index adceafd..48343d1 100644 --- a/lib/jmespath/parser.rb +++ b/lib/jmespath/parser.rb @@ -114,7 +114,11 @@ def nud_lbrace(stream) pairs = [] begin pairs << parse_key_value_pair(stream) - stream.next(match: valid_keys) if stream.token.type == :comma + if stream.token.type == :comma + stream.next(match: valid_keys) + elsif stream.token.type != :rbrace + raise Errors::SyntaxError, 'expected a comma or closing rbrace' + end end while stream.token.type != :rbrace stream.next Nodes::MultiSelectHash.new(pairs) @@ -215,7 +219,14 @@ def led_lparen(stream, left) stream.next while stream.token.type != :rparen args << expr(stream, 0) - stream.next if stream.token.type == :comma + if stream.token.type == :comma + stream.next + if stream.token.type == :rparen + raise Errors::SyntaxError, 'expression expected, found rparen' + end + elsif stream.token.type != :rparen + raise Errors::SyntaxError, 'expected a comma or closing rparen' + end end stream.next Nodes::Function.create(name, args, disable_visit_errors: @disable_visit_errors) @@ -294,8 +305,10 @@ def parse_multi_select_list(stream) if stream.token.type == :comma stream.next if stream.token.type == :rbracket - raise Errors::SyntaxError, 'expression epxected, found rbracket' + raise Errors::SyntaxError, 'expression expected, found rbracket' end + elsif stream.token.type != :rbracket + raise Errors::SyntaxError, 'expected a comma or closing rbracket' end end while stream.token.type != :rbracket stream.next