Perform input validation in JsonPoiner

stefankoegl · Oct 29, 2017 · 0d30f12 · 0d30f12
1 parent ba2af26
commit 0d30f12
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/jsonpointer.py b/jsonpointer.py
@@ -167,8 +167,16 @@ class JsonPointer(object):
     # Array indices must not contain:
     # leading zeros, signs, spaces, decimals, etc
     _RE_ARRAY_INDEX = re.compile('0|[1-9][0-9]*$')
+    _RE_INVALID_ESCAPE = re.compile('(~[^01]|~$)')
 
     def __init__(self, pointer):
+
+        # validate escapes
+        invalid_escape = self._RE_INVALID_ESCAPE.search(pointer)
+        if invalid_escape:
+            raise JsonPointerException('Found invalid escape {0}'.format(
+                invalid_escape.group()))
+
         parts = pointer.split('/')
         if parts.pop(0) != '':
             raise JsonPointerException('location must starts with /')

diff --git a/tests.py b/tests.py
@@ -126,6 +126,12 @@ def test_oob(self):
         doc = [0, 1, 2]
         self.assertRaises(JsonPointerException, resolve_pointer, doc, '/10')
 
+    def test_trailing_escape(self):
+        self.assertRaises(JsonPointerException, JsonPointer, '/foo/bar~')
+
+    def test_invalid_escape(self):
+        self.assertRaises(JsonPointerException, JsonPointer, '/foo/bar~2')
+
 
 class ToLastTests(unittest.TestCase):