fix(read): prevent panic on negative slice index in a key path

GetValue and Exists validated only the upper bound of a numeric key-path
segment, so a negative index such as "arr.-1" passed the check and indexed
the slice with -1, causing an index-out-of-range panic. Add a lower-bound
check (i < 0) to the []int, []string and []any cases in both functions.
This commit is contained in:
dualfroz committed 2026-09-04 09:24:12 +02:00
1 parent a78ca9b221
commit 76e67fb3e0
3 files changed
+86 -6

No files matched your search

+22
View File
@@ -499,3 +499,25 @@ func TestConfig_Duration_getter(t *testing.T) {
is.Eq(7*time.Second, c.Duration("missing", 7*time.Second))
is.Eq(time.Duration(0), c.Duration("missing"))
}
func TestConfig_GetValue_negativeIndex(t *testing.T) {
is := assert.New(t)
c := New("test-neg")
err := c.LoadData(map[string]any{
"arr": []any{"a", "b", "c"},
})
is.NoErr(err)
// A negative slice index in a key path must not panic; it is simply
// treated as not found.
is.NotPanics(func() {
v, ok := c.GetValue("arr.-1")
is.False(ok)
is.Nil(v)
})
is.NotPanics(func() {
is.False(c.Exists("arr.-1"))
})
}