Reject embedded NUL bytes in module import paths

Browse Source

jq accepts embedded NUL bytes at the language level but resolves
module import paths through NUL-terminated C strings, so the path
validated by policy or audit code could differ from the on-disk
path jq actually opens. Pass jv through gen_import so the AST
preserves the original bytes, and reject embedded NULs in
validate_relpath.

Fixes CVE-2026-43895.

...

This commit is contained in:

itchyny committed 2026-05-09 17:08:43 +09:00

1 parent 9761ceb7d6

commit 9d223f153c

6 files changed

+314 -309

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/parser.c

Generated

+280 -290

File diff suppressed because it is too large. Load diff