One could assign a property [?(@.<property>=<value>)], it changes output

[vladvershinin]

Describe the bug

If you put = instead of == or === in filter expression [?(@.<property>=<value>], it actually replaces in the result all values of that <property> with new <value>.

Code sample or steps to reproduce

{
  "books": [
    {
      "id": 1,
      "name": "HPMOR"
    },
    {
      "id": 2,
      "name": "TG"
    }
  ]
}

Json path

$..books[?(@.id=55)]

Result:

[
  {
    "id": 55,
    "name": "HPMOR"
  },
  {
    "id": 55,
    "name": "TG"
  }
]

Console error or logs

Tried this on https://jsonpath-plus.github.io/JSONPath/demo/ site, there were no errors in logs.

Expected behavior

I would prefer this handled as invalid syntax.

Expected result

hmm, it could be empty, idk

Environment (IMPORTANT)

Tried this on https://jsonpath-plus.github.io/JSONPath/demo/, sorry, can't find the version it uses.

Desktop**

• OS: MacOS Monterey 12.2.1
• Browser and version Mozilla 101.0

Additional context

Actually, this caught me in https://github.com/Kong/insomnia, but found this behavior in the library itself.
According to http://jsonpath.com/, original implementation has this issue too.

PS
Sorry, I am not a JS developer, cannot provide all details and didn't manage to track the root of the problem further.

[brettz9]

Yes, this is a result of the fact that eval is used to evaluate filters. Closing, as this is effectively a dupe of #60 .

But please note that this library is no longer under active development. But if someone supplies a well-documented PR, we may be able to review, so you could watch #60 in case that occurs.

[vladvershinin]

Thank you for your attention!

[80avin]

Hey @vladvershinin .
I know this is old issue, but JSONPath-Plus is now safe by default and errors out on the expression you provided.

It'll throw

index-browser-umd.cjs:2162 Uncaught Error: jsonPath: Invalid left-hand side in assignment: @.id=55