jmespath / jmespath/go-jmespath

Possible error in lexer.go

Open
#97 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
621
Forks
101
PR merge metrics
No merged PRs in 30d

Description

Hi!
I checked my project, which has the go-jmespath library in its dependencies, with the SAST tool and found some problems in the go-jmespath code.

[On line 389](https://github.com/jmespath/go-jmespath/blob/v0.4.0/lexer.go#L389), SAST was triggered by a possible index out of range problem.
```go
func (lexer *Lexer) consumeUnquotedIdentifier() token {
// Consume runes until we reach the end of an unquoted
// identifier.
start := lexer.currentPos - lexer.lastWidth
for {
r := lexer.next()
if r < 0 || r > 128 || identifierTrailingBits[uint64(r)/64]&(1<<(uint64(r)%64)) == 0 {
lexer.back()
break
}
}
value := lexer.expression[start:lexer.currentPos]
return token{
tokenType: tUnquotedIdentifier,
value: value,
position: start,
length: lexer.currentPos - start,
}
}
```

I found that when `r = 128` a panic occurs

```go
package main

import "fmt"

func main() {
var identifierTrailingBits = [2]uint64{287948901175001088, 576460745995190270}

var r rune = 128
if r < 0 || r > 128 || identifierTrailingBits[uint64(r)/64]&(1<<(uint64(r)%64)) == 0 {
fmt.Println("yes")
} else {
fmt.Println("no")
}
}
```
result
```
panic: runtime error: index out of range [2] with length 2
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.