Merge pull request #276 from dbarrosop/master

buger · web-flow · commit a69e7e01cd4a · 2026-03-19T15:47:58.000+03:00
fix: prevent panic on negative slice index in Delete with malformed JSON (GO-2026-4514)
diff --git a/parser.go b/parser.go
@@ -731,7 +731,7 @@ func Delete(data []byte, keys ...string) []byte {
 	if !array {
 		if len(keys) > 1 {
 			_, _, startOffset, endOffset, err = internalGet(data, keys[:lk-1]...)
-			if err == KeyPathNotFoundError {
+			if err != nil {
 				// problem parsing the data
 				return data
 			}
@@ -743,7 +743,11 @@ func Delete(data []byte, keys ...string) []byte {
 			return data
 		}
 		keyOffset += startOffset
-		_, _, _, subEndOffset, _ := internalGet(data[startOffset:endOffset], keys[lk-1])
+		var subEndOffset int
+		_, _, _, subEndOffset, err = internalGet(data[startOffset:endOffset], keys[lk-1])
+		if err != nil {
+			return data
+		}
 		endOffset = startOffset + subEndOffset
 		tokEnd := tokenEnd(data[endOffset:])
 		tokStart := findTokenStart(data[:keyOffset], ","[0])
@@ -757,7 +761,7 @@ func Delete(data []byte, keys ...string) []byte {
 		}
 	} else {
 		_, _, keyOffset, endOffset, err = internalGet(data, keys...)
-		if err == KeyPathNotFoundError {
+		if err != nil {
 			// problem parsing the data
 			return data
 		}
diff --git a/parser_test.go b/parser_test.go
@@ -227,6 +227,24 @@ var deleteTests = []DeleteTest{
 		path: []string{"test"},
 		data: `   {}`,
 	},
+	{
+		desc: "GO-2026-4514: malformed JSON without enclosing braces should not panic",
+		json: `"0":"0":`,
+		path: []string{"0"},
+		data: `"0":"0":`,
+	},
+	{
+		desc: "GO-2026-4514: malformed JSON with key but truncated value should not panic",
+		json: `{"a":  `,
+		path: []string{"a"},
+		data: `{"a":  `,
+	},
+	{
+		desc: "GO-2026-4514: malformed nested JSON with truncated value should not panic",
+		json: `{"a":{"b":  `,
+		path: []string{"a", "b"},
+		data: `{"a":{"b":  `,
+	},
 }
 
 var setTests = []SetTest{
