vsndrg/jq
1
0 Fork 0
mirror of https://github.com/jqlang/jq.git synced 2026-11-02 17:51:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reject embedded NUL bytes in module import paths

Browse Source 
jq accepts embedded NUL bytes at the language level but resolves
module import paths through NUL-terminated C strings, so the path
validated by policy or audit code could differ from the on-disk
path jq actually opens. Pass jv through gen_import so the AST
preserves the original bytes, and reject embedded NULs in
validate_relpath.

Fixes CVE-2026-43895.
This commit is contained in:
itchyny committed 2026-05-09 17:08:43 +09:00
1 parent 9761ceb7d6
commit 9d223f153c
6 files changed
+314 -309
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/parser.y
+3 -13
View File
@@ -439,26 +439,16 @@ ImportWhat Query ';' {
ImportWhat:
"import" ImportFrom "as" BINDING {
jv v = block_const($2);
// XXX Make gen_import take only blocks and the int is_data so we
// don't have to free so much stuff here
$$ = gen_import(jv_string_value(v), jv_string_value($4), 1);
$$ = gen_import(block_const($2), $4, 1);
block_free($2);
jv_free($4);
jv_free(v);
} |
"import" ImportFrom "as" IDENT {
jv v = block_const($2);
$$ = gen_import(jv_string_value(v), jv_string_value($4), 0);
$$ = gen_import(block_const($2), $4, 0);
block_free($2);
jv_free($4);
jv_free(v);
} |
"include" ImportFrom {
jv v = block_const($2);
$$ = gen_import(jv_string_value(v), NULL, 0);
$$ = gen_import(block_const($2), jv_invalid(), 0);
block_free($2);
jv_free(v);
}
ImportFrom: