- **Backward incompatible** and **security-related** change to parsing "lookup" strings.

This version restricts the supported syntax for bracketed ["lookup"

strings](https://trentm.com/json/#FEATURE-Lookups) to fix a possible

vulnerability (CVE-2020-7712). With a carefully crafted lookup string,

command injection was possible. See

[#144](https://github.com/trentm/json/issues/144) for a repro. If you use

`json` (the CLI or as a node.js module) and run arbitrary user-provided

strings as a "lookup", then you should upgrade.

For the `json` CLI, a "lookup" string is the 'foo' in:

echo ...some json... | json foo

which allows you to lookup fields on the given JSON, e.g.:

$ echo '{"foo": {"bar": "baz"}}' | json foo.bar

baz

If one of the lookup fields isn't a valid JS identifier, then the JS array

notation is supported:

$ echo '{"http://example.com": "my-value"}' | json '["http://example.com"]'

my-value

Before this change, `json` would effectively *exec* the string between the

brackets as JS code such that things like the following were possible:

$ echo '{"foo3": "bar"}' | json '["foo" + 3]'

bar

This change limits supported bracket syntax in lookups to a simple quoted

string:

["..."]

['...']

[`...`] # no variable interpolation

Otherwise generating an error of the form:

json: error: invalid bracketed lookup string: "[\"foo\" + 3]" (must be of the form ['...'], ["..."], or [`...`])

var VERSION = '10.0.0';

// var debug = console.warn;

// Handle a *limited subset* of JS string escapes.

// JSSTYLED

// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String#Escape_notation

var SUPPORTED_ESCAPES = {

'\'': '\'',

'\"': '\"',

'\`': '\`',

'\\': '\\',

'n': '\n',

'r': '\r',

't': '\t',

'v': '\v',

'b': '\b',

'f': '\f'

};

if (ch === '\\' && i+1 < lookup.length) {

var nextCh = lookup[i+1];

var escapedCh = SUPPORTED_ESCAPES[nextCh];

if (escapedCh !== undefined) {

debug('escaped: %j -> %j', ch+nextCh, escapedCh);

bit += escapedCh;

i++;

continue;

}

// `bit` is a bracketed string, `[...]`.

//

// The *intent* is to allow specifying an object key

// that would otherwise get interpreted by `json`s

// LOOKUP parsing -- typically if the key has a `.` in it.

//

// Up to and including json v9, this was handled by eval'ing

// the given string inside the brackets (via

// `vm.runInNewContext`). However, trentm/json#144 shows

// that this is an avenue for command injection. It was

// never made clear in `json` documentation that one

// should never use user-provided strings for LOOKUPs, so

// we should close this vulnerability.

//

// Expected usage and documented examples are like this:

// ["foo.bar"]

// ['foo.bar']

// However, older implementation of eval'ing meant that

// things like the following worked:

// [42]

// ["my" + "key"]

// [(function () { return "mykey" })()]

//

// The documentation was never explicit about denying

// expressions would work. v10 **breaks compatibility**

// to only support a bracketed string:

// ["..."]

// ['...']

// [`...`] # note: no var interpolation is done

// and error otherwise.

var VALID_QUOTES = '"\'`';

var sQuote = bit[1];

var eQuote = bit.slice(-2, -1);

if (VALID_QUOTES.indexOf(sQuote) === -1 ||

sQuote !== eQuote)

{

throw new Error(format('invalid bracketed lookup ' +

'string: %j (must be of the form [\'...\'], ' +

'["..."], or [`...`])', bit));

}

bits.push(bit.slice(2, -2));

try {

var lookups = lookupStrs.map(function (lookup) {

return parseLookup(lookup, opts.lookupDelim);

});

} catch (e) {

warn('json: error: %s', e.message)

return drainStdoutAndExit(1);

}

"version": "10.0.0",

"man": [

"./man/man1/json.1"

],

"bin": {

"json": "./lib/json.js"

},

"keywords": [

"json",

"jsontool",

"filter",

"command",

"shell"

],

# Test the json v10 change to limit the allowe bracketed lookup syntax.

JSON=../../lib/json.js

echo '{"foo42":"bar"}' | $JSON foo42

echo '{"foo42":"bar"}' | $JSON '["foo42"]'

# This one used to work in json <v10. No longer.

echo '{"foo42":"bar"}' | $JSON '["foo" + 42]'

json: error: invalid bracketed lookup string: "[\"foo\" + 42]" (must be of the form ['...'], ["..."], or [`...`])

bar

bar

test.deepEqual(parseLookup('a.b/c["d"]', '/'), ['a.b', 'c', 'd']);