Skip to content

fix: disable getting unsafe and unsupported properties via function get #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
josdejong merged 2 commits into from
Dec 9, 2025
Merged

fix: disable getting unsafe and unsupported properties via function get #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
62b26f9
fix: disallow getting unsafe properties using function `get`
josdejong Dec 8, 2025
b7d5494
fix: simplify and improve getSafeProperty
josdejong Dec 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Try it out on the online playground: <https://jsonquerylang.org>

## Features

- Small: just `4.1 kB` when minified and gzipped! The JSON query engine without parse/stringify is only `2.1 kB`.
- Small: just `4.2 kB` when minified and gzipped! The JSON query engine without parse/stringify is only `2.2 kB`.
- Feature rich (50+ powerful functions and operators)
- Easy to interoperate with thanks to the intermediate JSON format.
- Expressive
Expand Down
23 changes: 23 additions & 0 deletions src/compile.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,29 @@ for (const [category, testGroups] of Object.entries(testsByCategory)) {
}

describe('error handling', () => {
test('should throw an error when trying to get a property from something that is not a plain object', () => {
const obj = { value: 42 }
expect(() => compile(['get', 'constructor'])(obj)).toThrow('Unsupported property "constructor"')
expect(() => compile(['get', '__proto__'])(obj)).toThrow('Unsupported property "__proto__"')

// we could technically support this, but we only support plain objects for now to keep the implementation simple
const createdObj = Object.create(obj)
expect(() => compile(['get', 'value'])(createdObj)).toThrow('Unsupported property "value"')
expect(() => compile(['get', 'constructor'])(createdObj)).toThrow(
'Unsupported property "constructor"'
)
expect(() => compile(['get', '__proto__'])(createdObj)).toThrow(
'Unsupported property "__proto__"'
)

const arr = [40, 41, 42]
expect(() => compile(['get', 'constructor'])(arr)).toThrow('Unsupported property "constructor"')
expect(() => compile(['get', '__proto__'])(arr)).toThrow('Unsupported property "__proto__"')
expect(() => compile(['get', 'length'])(arr)).toThrow('Unsupported property "length"')

expect(() => compile(['get', 'length'])('text')).toThrow('Unsupported property "length"')
})

test('should throw a helpful error when a pipe contains a compile time error', () => {
let actualErr = undefined
try {
Expand Down
6 changes: 3 additions & 3 deletions src/functions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
import { compile } from './compile'
import { isArray, isEqual } from './is'
import { getSafeProperty, isArray, isEqual } from './is'
import type {
Entry,
FunctionBuilder,
Expand Down Expand Up @@ -72,14 +72,14 @@ export const functions: FunctionBuildersMap = {

if (path.length === 1) {
const prop = path[0]
return (data: unknown) => data?.[prop] ?? null
return (data: unknown) => getSafeProperty(data, prop) ?? null
}

return (data: unknown) => {
let value = data

for (const prop of path) {
value = value?.[prop]
value = getSafeProperty(value, prop)
}

return value ?? null
Expand Down
22 changes: 22 additions & 0 deletions src/is.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
import { expect, test } from 'vitest'
import { getSafeProperty } from './is'

test('getSafeProperty', () => {
const obj = { value: 42 }
expect(getSafeProperty(obj, 'value')).toEqual(42)
expect(getSafeProperty(obj, 'foo')).toEqual(undefined)
expect(() => getSafeProperty(obj, 'constructor')).toThrow(/Unsupported property "constructor"/)
expect(() => getSafeProperty(obj, '__proto__')).toThrow(/Unsupported property "__proto__"/)
expect(() => getSafeProperty(obj, 'valueOf')).toThrow(/Unsupported property "valueOf"/)

const arr = [40, 41, 42]
expect(getSafeProperty(arr, '2')).toEqual(42)
expect(getSafeProperty(arr, 2)).toEqual(42)
expect(() => getSafeProperty(arr, 'constructor')).toThrow(/Unsupported property "constructor"/)
expect(() => getSafeProperty(arr, '__proto__')).toThrow(/Unsupported property "__proto__"/)
expect(() => getSafeProperty(arr, 'length')).toThrow(/Unsupported property "length"/)
expect(() => getSafeProperty(arr, 'map')).toThrow(/Unsupported property "map"/)

expect(getSafeProperty(null, 'foo')).toEqual(undefined)
expect(getSafeProperty(undefined, 'foo')).toEqual(undefined)
})
20 changes: 20 additions & 0 deletions src/is.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,23 @@ export const isEqual = <T>(a: T, b: T): boolean => {
Object.entries(a).every(([k, v]) => isEqual(v, b[k as keyof T]))
)
}

export const getSafeProperty = (object: unknown, prop: string | number): unknown => {
const value = object?.[prop]
if (value === undefined) {
return undefined
}

// 1. do not allow getting props from the prototype (can be unsafe, like .constructor)
// 2. in case of an array, test if prop is an int
// 3. do not allow getting props from a string or number for example
if (
!Object.hasOwn(object as object, prop) ||
(Array.isArray(object) && !/^\d+$/.test(prop as string)) ||
typeof object !== 'object'
) {
throw new TypeError(`Unsupported property "${prop}"`)
}

return value
}
8 changes: 8 additions & 0 deletions test-suite/compile.test.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,6 +223,14 @@
}
]
},
{
"category": "get",
"description": "should get a path that has the same name as an unsupported property",
"tests": [
{ "input": { "length": 42 }, "query": ["get", "length"], "output": 42 },
{ "input": { "constructor": "yes" }, "query": ["get", "constructor"], "output": "yes" }
]
},
{
"category": "get",
"description": "should get a nested value that has the same name as a function",
Expand Down
4 changes: 0 additions & 4 deletions test-suite/parse.test.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,10 +65,6 @@
{
"input": ".data | groupBy(.city).myCity",
"output": ["pipe", ["get", "data"], ["groupBy", ["get", "city"]], ["get", "myCity"]]
},
{
"input": "\"hello\".length",
"output": ["pipe", "hello", ["get", "length"]]
}
]
},
Expand Down