require string type for patch op/path/from fields

This commit is contained in:
Javid Khan
2026-07-18 21:08:17 +05:30
parent eed664e06a
commit e248056aa1
3 changed files with 13 additions and 3 deletions
+5 -3
View File
@@ -208,7 +208,7 @@ static int json_patch_apply_move_copy(struct json_object **res,
return -1;
}
from_s = json_object_get_string(jfrom);
from_s = json_object_get_type(jfrom) == json_type_string ? json_object_get_string(jfrom) : NULL;
if (from_s == NULL) {
_set_err(EINVAL, "Patch object 'from' field is not a string");
return -1;
@@ -323,7 +323,7 @@ int json_patch_apply(struct json_object *copy_from, struct json_object *patch,
_set_err(EINVAL, "Patch object does not contain 'op' field");
return -1;
}
op = json_object_get_string(jop);
op = json_object_get_type(jop) == json_type_string ? json_object_get_string(jop) : NULL;
if (op == NULL) {
_set_err(EINVAL, "Patch object 'op' field is not a string");
return -1;
@@ -332,7 +332,9 @@ int json_patch_apply(struct json_object *copy_from, struct json_object *patch,
_set_err(EINVAL, "Patch object does not contain 'path' field");
return -1;
}
path = json_object_get_string(jpath); // Note: empty string is ok!
// Note: empty string is ok!
path = json_object_get_type(jpath) == json_type_string ? json_object_get_string(jpath)
: NULL;
if (path == NULL) {
_set_err(EINVAL, "Patch object 'path' field is not a string");
return -1;
+6
View File
@@ -554,6 +554,12 @@
"doc": {"foo": "bar"},
"patch": [{"op": "move", "from": null, "path": "/foo"}],
"error": "a null from field should fail rather than crash"
},
{ "comment": "null path field must be rejected, not dereferenced",
"doc": {"foo": "bar"},
"patch": [{"op": "remove", "path": null}],
"error": "a null path field should fail rather than crash"
}
]
+2
View File
@@ -161,3 +161,5 @@ Testing 'null op field must be rejected, not dereferenced', doc '{ "foo": "bar"
=> json_patch_apply failed as expected: ERRNO=EINVAL at patch idx 0: Patch object 'op' field is not a string
Testing 'null from field must be rejected, not dereferenced', doc '{ "foo": "bar" }' patch '[ { "op": "move", "from": null, "path": "\/foo" } ]' : OK
=> json_patch_apply failed as expected: ERRNO=EINVAL at patch idx 0: Patch object 'from' field is not a string
Testing 'null path field must be rejected, not dereferenced', doc '{ "foo": "bar" }' patch '[ { "op": "remove", "path": null } ]' : OK
=> json_patch_apply failed as expected: ERRNO=EINVAL at patch idx 0: Patch object 'path' field is not a string