Skip to content

Array path helpers accept malformed RFC 6902 indexes #326

Description

@simonyang08

Reproduction

const data = { items: ["a", "b", "c"] };

getByPath(data, "/items/1foo"); // "b"
setByPath(data, "/items/01", "x"); // writes index 1
addByPath(data, "/items/1.5", "x"); // inserts at index 1
removeByPath(data, "/items/-1"); // may address a non-index array property

The state-store path setter has the same parsing behavior.

Expected behavior

When the current container is an array, path tokens should follow the RFC 6902 array-index grammar: 0 or a non-zero digit followed by digits. Partial numeric strings, leading zeros, decimals, negative values, and integers that cannot be represented safely should be rejected rather than coerced with parseInt.

Object member names should remain unrestricted, including numeric-looking keys.

Proposed fix

Use strict, safe-integer parsing only while traversing arrays, preserve object-key behavior, and add regression coverage for mutable path helpers and state-store writes.

I have a focused patch ready with regression tests.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions