SQL/JSON: Correct jsonpath variable name matching

amitlan · amitlan · commit 0f271e8e8d9c · 2024-06-19T15:22:06.000+09:00
Previously, GetJsonPathVar() allowed a jsonpath expression to reference any prefix of a PASSING variable's name. For example, the following query would incorrectly work: SELECT JSON_QUERY(context_item, jsonpath '$xy' PASSING val AS xyz); The fix ensures that the length of the variable name mentioned in a jsonpath expression matches exactly with the name of the PASSING variable before comparing the strings using strncmp(). Reported-by: Alvaro Herrera (off-list) Discussion: https://postgr.es/m/CA+HiwqFGkLWMvELBH6E4SQ45qUHthgcRH6gCJL20OsYDRtFx_w@mail.gmail.com
diff --git a/src/backend/executor/execExpr.c b/src/backend/executor/execExpr.c
@@ -4278,6 +4278,7 @@ ExecInitJsonExpr(JsonExpr *jsexpr, ExprState *state,
 		JsonPathVariable *var = palloc(sizeof(*var));
 
 		var->name = argname->sval;
+		var->namelen = strlen(var->name);
 		var->typid = exprType((Node *) argexpr);
 		var->typmod = exprTypmod((Node *) argexpr);
 
diff --git a/src/backend/utils/adt/jsonpath_exec.c b/src/backend/utils/adt/jsonpath_exec.c
@@ -2994,7 +2994,8 @@ GetJsonPathVar(void *cxt, char *varName, int varNameLen,
 	{
 		JsonPathVariable *curvar = lfirst(lc);
 
-		if (!strncmp(curvar->name, varName, varNameLen))
+		if (curvar->namelen == varNameLen &&
+			strncmp(curvar->name, varName, varNameLen) == 0)
 		{
 			var = curvar;
 			break;
@@ -4118,6 +4119,7 @@ JsonTableInitOpaque(TableFuncScanState *state, int natts)
 			JsonPathVariable *var = palloc(sizeof(*var));
 
 			var->name = pstrdup(name->sval);
+			var->namelen = strlen(var->name);
 			var->typid = exprType((Node *) state->expr);
 			var->typmod = exprTypmod((Node *) state->expr);
 
diff --git a/src/include/utils/jsonpath.h b/src/include/utils/jsonpath.h
@@ -287,6 +287,7 @@ extern bool jspConvertRegexFlags(uint32 xflags, int *result,
 typedef struct JsonPathVariable
 {
 	char	   *name;
+	int			namelen;		/* strlen(name) as cache for GetJsonPathVar() */
 	Oid			typid;
 	int32		typmod;
 	Datum		value;
diff --git a/src/test/regress/expected/sqljson_queryfuncs.out b/src/test/regress/expected/sqljson_queryfuncs.out
@@ -1334,3 +1334,14 @@ SELECT json_value('"aaa"', path RETURNING json) FROM jsonpaths;
  "aaa"
 (1 row)
 
+-- Test PASSING argument parsing
+SELECT JSON_QUERY(jsonb 'null', '$xyz' PASSING 1 AS xy);
+ERROR:  could not find jsonpath variable "xyz"
+SELECT JSON_QUERY(jsonb 'null', '$xy' PASSING 1 AS xyz);
+ERROR:  could not find jsonpath variable "xy"
+SELECT JSON_QUERY(jsonb 'null', '$xyz' PASSING 1 AS xyz);
+ json_query 
+------------
+ 1
+(1 row)
+
diff --git a/src/test/regress/sql/sqljson_queryfuncs.sql b/src/test/regress/sql/sqljson_queryfuncs.sql
@@ -454,3 +454,8 @@ SELECT JSON_QUERY(NULL FORMAT JSON, '$');
 -- Test non-const jsonpath
 CREATE TEMP TABLE jsonpaths (path) AS SELECT '$';
 SELECT json_value('"aaa"', path RETURNING json) FROM jsonpaths;
+
+-- Test PASSING argument parsing
+SELECT JSON_QUERY(jsonb 'null', '$xyz' PASSING 1 AS xy);
+SELECT JSON_QUERY(jsonb 'null', '$xy' PASSING 1 AS xyz);
+SELECT JSON_QUERY(jsonb 'null', '$xyz' PASSING 1 AS xyz);

Original file line number	Diff line number	Diff line change
`@@ -2994,7 +2994,8 @@ GetJsonPathVar(void cxt, char varName, int varNameLen,`
`2994`	`2994`	`{`
`2995`	`2995`	`JsonPathVariable *curvar = lfirst(lc);`
`2996`	`2996`
`2997`		`- if (!strncmp(curvar->name, varName, varNameLen))`
	`2997`	`+ if (curvar->namelen == varNameLen &&`
	`2998`	`+ strncmp(curvar->name, varName, varNameLen) == 0)`
`2998`	`2999`	`{`
`2999`	`3000`	`var = curvar;`
`3000`	`3001`	`break;`
`@@ -4118,6 +4119,7 @@ JsonTableInitOpaque(TableFuncScanState *state, int natts)`
`4118`	`4119`	`JsonPathVariable var = palloc(sizeof(var));`
`4119`	`4120`
`4120`	`4121`	`var->name = pstrdup(name->sval);`
	`4122`	`+ var->namelen = strlen(var->name);`
`4121`	`4123`	`var->typid = exprType((Node *) state->expr);`
`4122`	`4124`	`var->typmod = exprTypmod((Node *) state->expr);`
`4123`	`4125`
Original file line number	Diff line number	Diff line change
`@@ -287,6 +287,7 @@ extern bool jspConvertRegexFlags(uint32 xflags, int *result,`
`287`	`287`	`typedef struct JsonPathVariable`
`288`	`288`	`{`
`289`	`289`	`char *name;`
	`290`	`+ int namelen; /* strlen(name) as cache for GetJsonPathVar() */`
`290`	`291`	`Oid typid;`
`291`	`292`	`int32 typmod;`
`292`	`293`	`Datum value;`