Repository navigation
BUG: JsonPointer.set() does not validate assignment target (RFC 6901 non-compliant) #77
Description
Summary
JsonPointer.set() does not validate the assignment target, so it raises
TypeError or IndexError instead of JsonPointerException. Mirror of #70
on the write path; PR #76 fixes resolve, set stays unguarded.
Reproduction
from jsonpointer import JsonPointer
JsonPointer("/0").set("abc", {"v": 1}, inplace=False)
# TypeError: 'str' object does not support item assignment
JsonPointer("/0").set([], 42, inplace=False)
# IndexError: list assignment index out of range
JsonPointer("/5").set([1, 2], 42, inplace=False)
# IndexError: list assignment index out of rangeRoot cause
if isinstance(parent, Sequence) and part == '-':
parent.append(value)
else:
parent[part] = value # str -> TypeError, list out of range -> IndexErrorstr is a Sequence, and there is no guard around the assignment.
Impact
jsonpatch catches IndexError but not TypeError, so JsonPatch.apply()
can raise TypeError on untrusted patch documents.
Environment
jsonpointer 3.1.1, Python 3.x, found by fuzzing
Metadata
Metadata
Assignees
Labels
No labels
Activity