Summary
JsonPointer.set() does not validate the assignment target, so it raises
TypeError or IndexError instead of JsonPointerException. Mirror of #70
on the write path; PR #76 fixes resolve, set stays unguarded.
Reproduction
from jsonpointer import JsonPointer
JsonPointer("/0").set("abc", {"v": 1}, inplace=False)
# TypeError: 'str' object does not support item assignment
JsonPointer("/0").set([], 42, inplace=False)
# IndexError: list assignment index out of range
JsonPointer("/5").set([1, 2], 42, inplace=False)
# IndexError: list assignment index out of range
Root cause
if isinstance(parent, Sequence) and part == '-':
parent.append(value)
else:
parent[part] = value # str -> TypeError, list out of range -> IndexError
str is a Sequence, and there is no guard around the assignment.
Impact
jsonpatch catches IndexError but not TypeError, so JsonPatch.apply()
can raise TypeError on untrusted patch documents.
Environment
jsonpointer 3.1.1, Python 3.x, found by fuzzing
Summary
JsonPointer.set()does not validate the assignment target, so it raisesTypeErrororIndexErrorinstead ofJsonPointerException. Mirror of #70on the write path; PR #76 fixes
resolve,setstays unguarded.Reproduction
Root cause
str is a Sequence, and there is no guard around the assignment.
Impact
jsonpatch catches IndexError but not TypeError, so JsonPatch.apply()
can raise TypeError on untrusted patch documents.
Environment
jsonpointer 3.1.1, Python 3.x, found by fuzzing