[JsonPath] Handle special whitespaces in expressions #60699

alexandre-daubois · 2025-06-05T07:33:00Z

Q	A
Branch?	7.3
Bug fix?	yes
New feature?	no
Deprecations?	no
Issues	-
License	MIT

Allows using chars like \n or \t in expression and treat them as normal spaces, as defined in https://datatracker.ietf.org/doc/rfc9535/, section 2.1.1. It is possible to write filters on multiple lines:

$
.store
.book[?
    length(@.author) > 12
    ||
    length(@.author) < 5
]

stof · 2025-06-05T09:28:35Z

src/Symfony/Component/JsonPath/JsonCrawler.php

@@ -163,13 +185,14 @@ private function evaluateBracket(string $expr, mixed $value): array
            return $result;
        }

-        // start, end and step
-        if (preg_match('/^(-?\d*):(-?\d*)(?::(-?\d+))?$/', $expr, $matches)) {
+        if (preg_match('/^(-?\d*)\s*:\s*(-?\d*)(?:\s*:\s*(-?\d+))?$/', $expr, $matches)) {


I suggest changing all those * to *+.
Due to the structure of the regex, using possessive quantifiers will match exactly the same, but it will avoid useless backtracking for non-matching strings (a very smart regex compiler might be able to automatically make them possessive as an optimization, but I'm not sure PCRE is doing it)

stof · 2025-06-05T09:30:54Z

src/Symfony/Component/JsonPath/JsonCrawler.php

@@ -211,8 +234,8 @@ private function evaluateBracket(string $expr, mixed $value): array
        }

        // filter expressions
-        if (preg_match('/^\?(.*)$/', $expr, $matches)) {
-            $filterExpr = $matches[1];
+        if (preg_match('/^\?\s*(.*)$/', $expr, $matches)) {


Suggested change

if (preg_match('/^\?\s*(.*)$/', $expr, $matches)) {

if (preg_match('/^\?\s*+(.*)$/', $expr, $matches)) {

In this case, we want the possessive quantifier to ensure that all spaces are always consumed by the \s* part, as we have 2 consecutive quantifiers that could consume them, which is the typical ReDoS pattern.
Alternatively, let spaces be consumed by the (.*) (as done before) and be cleaned by the trimming on next line.

stof · 2025-06-05T09:33:02Z

src/Symfony/Component/JsonPath/JsonCrawler.php

@@ -346,7 +373,7 @@ private function evaluateScalar(string $expr, array $context): mixed
        }

        // function calls
-        if (preg_match('/^(\w+)\((.*)\)$/', $expr, $matches)) {
+        if (preg_match('/^(\w+)\s*\(\s*(.*)\s*\)$/', $expr, $matches)) {


\s*(.*)\s*\ will be a ReDoS pattern for non-matching strings (and it does not even ensure the last \s* consumes the trailing spaces).

It would be simpler to let the (.*) match all the content between the braces and to trim $matches[2] before using it.

alexandre-daubois · 2025-06-05T17:30:31Z

Thank you @stof, I didn't know that denial of service was actually a thing with regex. I updated accordingly.

stof · 2025-06-05T18:18:51Z

@alexandre-daubois this can be a thing when you allow user input for the string being matched by the regex (which could totally happen in this component). Backtracking engines (like PCRE) have an exponential complexity based on the length of the input when attempting to match an affected regex (and failing to match it, as this is the worse case of backtracking).

This is commonly reported in the npm ecosystem (also because JS does not support possessive quantifiers in its Regexp syntax, and so cannot apply the easy fix to prevent them in many cases, making the issue more common)

stof · 2025-06-09T08:25:35Z

src/Symfony/Component/JsonPath/JsonCrawler.php

+    private function splitByOperator(string $expr, string $operator): array
+    {
+        $normalizedExpr = JsonPathUtils::normalizeWhitespace($expr);
+        $pattern = '/\s*'.preg_quote($operator, '/').'\s*/';


I'm quite sure you could use possessive quantifiers there too.

stof · 2025-06-09T08:26:14Z

src/Symfony/Component/JsonPath/JsonCrawler.php

+    private function containsOperator(string $expr, string $operator): bool
+    {
+        $normalizedExpr = JsonPathUtils::normalizeWhitespace($expr);
+        $pattern = '/\s*'.preg_quote($operator, '/').'\s*/';


stof · 2025-06-09T08:26:26Z

src/Symfony/Component/JsonPath/JsonCrawler.php

@@ -150,8 +172,8 @@ private function evaluateBracket(string $expr, mixed $value): array
            }

            $result = [];
-            foreach (explode(',', $expr) as $index) {
-                $index = (int) trim($index);
+            foreach (preg_split('/\s*,\s*/', $expr) as $indexStr) {


this could be possessive quantifiers as well.

Alternatively, keep the explode as you are trimming strings below anyway. Maybe it is more efficient.

stof · 2025-06-09T08:27:52Z

src/Symfony/Component/JsonPath/JsonCrawler.php

            if (!array_is_list($value)) {
                return [];
            }

            $length = \count($value);
+            $matches = array_map('trim', $matches);


not needed. The regex does not allow the matches to have leading or trailing spaces in matched groups, so this will be be a no-op.

stof · 2025-06-09T08:28:58Z

src/Symfony/Component/JsonPath/JsonCrawler.php

                    return false;
                }
            }

            return true;
        }

-        if (str_contains($expr, '||')) {
-            $parts = array_map('trim', explode('||', $expr));
+        if ($this->containsOperator($expr, '||')) {


You could keep using str_contains($expr, '||') which is likely more efficient than a regex match. It won't change the result.

stof · 2025-06-09T08:29:16Z

src/Symfony/Component/JsonPath/JsonCrawler.php

-        if (str_contains($expr, '||')) {
-            $parts = array_map('trim', explode('||', $expr));
+        if ($this->containsOperator($expr, '||')) {
+            $parts = preg_split('/\s*\|\|\s*/', $expr);


you could keep using explode as you trim parts below anyway.

stof · 2025-06-09T08:30:25Z

src/Symfony/Component/JsonPath/JsonCrawler.php

+        return [];
+    }
+
+    private function containsOperator(string $expr, string $operator): bool


This method should be dropped IMO. The str_contains check was enough, as we don't have spaces inside operators (and spaces around them won't change the contains result)

stof · 2025-06-09T08:31:55Z

src/Symfony/Component/JsonPath/JsonCrawler.php

@@ -301,7 +326,7 @@ private function evaluateFilterExpression(string $expr, array $context): bool
        }

        // function calls
-        if (preg_match('/^(\w+)\((.*)\)$/', $expr, $matches)) {
+        if (preg_match('/^(\w+)\s*\(\s*(.*)\s*\)$/', $expr, $matches)) {


Suggested change

if (preg_match('/^(\w+)\s*$\s*(.*)\s*$$/', $expr, $matches)) {

if (preg_match('/^(\w++)\s*+$(.*)$$/', $expr, $matches)) {

And then trimming matches[1] (as the current regex does not even guarantee that the trailing spaces will be matched by the \s* part so you still need trimming)

stof · 2025-06-09T08:32:13Z

src/Symfony/Component/JsonPath/JsonCrawler.php

@@ -346,7 +373,7 @@ private function evaluateScalar(string $expr, array $context): mixed
        }

        // function calls
-        if (preg_match('/^(\w+)\((.*)\)$/', $expr, $matches)) {
+        if (preg_match('/^(\w+)\s*\((.*)\)$/', $expr, $matches)) {


Suggested change

if (preg_match('/^(\w+)\s*$(.*)$$/', $expr, $matches)) {

if (preg_match('/^(\w++)\s*+$(.*)$$/', $expr, $matches)) {

carsonbot added Status: Needs Review Bug JsonPath labels Jun 5, 2025

carsonbot added this to the 7.3 milestone Jun 5, 2025

alexandre-daubois force-pushed the jsonpath-blankspaces branch from ba52060 to 9ceeb5f Compare June 5, 2025 07:43

alexandre-daubois changed the title ~~[JsonPath] Handle special whitespaces in filters~~ [JsonPath] Handle special whitespaces in expressions Jun 5, 2025

stof requested changes Jun 5, 2025

View reviewed changes

carsonbot added Status: Needs Work and removed Status: Needs Review labels Jun 5, 2025

alexandre-daubois force-pushed the jsonpath-blankspaces branch from 9ceeb5f to 9e73c21 Compare June 5, 2025 17:29

[JsonPath] Handle special whitespaces in filters

2c412e1

alexandre-daubois force-pushed the jsonpath-blankspaces branch from 9e73c21 to 2c412e1 Compare June 6, 2025 07:30

stof approved these changes Jun 9, 2025

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Work labels Jun 9, 2025

stof reviewed Jun 9, 2025

View reviewed changes

	if (preg_match('/^\?\s(.)$/', $expr, $matches)) {
	if (preg_match('/^\?\s+(.)$/', $expr, $matches)) {

	if (preg_match('/^(\w+)\s\(\s(.)\s\)$/', $expr, $matches)) {
	if (preg_match('/^(\w++)\s+\((.)\)$/', $expr, $matches)) {

	if (preg_match('/^(\w+)\s\((.)\)$/', $expr, $matches)) {
	if (preg_match('/^(\w++)\s+\((.)\)$/', $expr, $matches)) {

Uh oh!

[JsonPath] Handle special whitespaces in expressions #60699

Are you sure you want to change the base?

[JsonPath] Handle special whitespaces in expressions #60699

Uh oh!

Conversation

alexandre-daubois commented Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexandre-daubois commented Jun 5, 2025

Uh oh!

stof commented Jun 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

alexandre-daubois commented Jun 5, 2025 •

edited

Loading