Repository navigation
fix: reject container access through null JSON fields - #1981
Open
Rexyysilent wants to merge 1 commit into
Open
Rexyysilent wants to merge 1 commit into
Rexyysilent wants to merge 1 commit into
Conversation
Initialize the root context before walking a nested JSON path. A null object member then reaches the existing type checks instead of replacing the entire root and discarding previously supplied request fields. Cover key, index, and append access in nested objects and top-level arrays, plus null values, direct overrides, and sparse array filling. Co-authored-by: Codex <noreply@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Accessing a child of a null-valued JSON object member silently replaces the whole request body. This offline command currently prints only
{"bar": "baz"}, dropping bothkeepandfoo:http --offline --print=B example.org keep=value foo:=null 'foo[bar]=baz'Initialize the root context before walking the path, so a nested
Nonereaches the existing type check. The command then reportsHTTPie Type Erroratfoo[bar]and exits with status 1, consistent with the documented nested JSON type checks.The tests cover key, index, and append access through null object members at three nesting positions. All nine regression cases fail before the fix and pass afterward. Three additional cases check that ordinary null values, direct value overrides, and filling sparse array entries still work. The changelog describes the corrected behavior.
Validation on Windows / Python 3.13.14:
test_json,test_offline,test_cli,test_cli_utils,test_cli_ui,test_errors, andtest_parser_schema.make codestyleFlake8 command passed (run directly on Windows).Prepared with OpenAI Codex assistance. Commit credit: @Rexyysilent, with a Codex co-author trailer.
model_string: OpenAI_DaybreakAstrais a user-requested custom attribution label, not verified runtime model metadata.CI note: the Ubuntu / Python 3.7 job currently fails in
actions/setup-python, before tests run, because Python 3.7 is unavailable for Ubuntu 24.04 (job log). The remaining checks are still in progress.Further CI results: Ubuntu / Python 3.11 reached 1,029 passed, with only the two Big5 charset-detection tests failing (job log). Both failures also reproduce locally with the original, unmodified JSON interpreter. A PyOpenSSL-enabled job additionally fails two existing digest-auth tests because an SSL context cannot be mutated after use (job log). These CI failures are recorded here rather than claimed as passing.