Skip to content

Conversation

@twobiers
Copy link
Contributor

@twobiers twobiers commented Jan 18, 2024

This PR shows a simple fix for the CVE-2023-51074.
It consists of a simple check whether a closing bracket actually exists.

Closes #970, Closes #973

@twobiers twobiers changed the title Check for the existence of the next significant bracket (Closes #970, Closes #973) Check for the existence of the next significant bracket Jan 18, 2024
@kallestenflo kallestenflo merged commit 71a09c1 into json-path:master Jan 18, 2024
@adriantcatch
Copy link

@kallestenflo - just wondering if there will be a new release soon? The CVE this resolves is flagged by our SCA tool and is causing headaches here!

@kallestenflo
Copy link
Contributor

kallestenflo commented Jan 19, 2024 via email

@sarahcpage
Copy link

Hi, is there an update on a release? Thank you.

@twobiers
Copy link
Contributor Author

Hi, is there an update on a release? Thank you.

Yes: https://github.com/json-path/JsonPath/releases/tag/json-path-2.9.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Stack Overflow (Criteria.parse) Stack Overflow (Criteria.where())

4 participants