diff --git a/framework/override_utils.go b/framework/override_utils.go index e54908e..49ed953 100644 --- a/framework/override_utils.go +++ b/framework/override_utils.go @@ -145,6 +145,10 @@ func overridePathInArray(input []interface{}, path []string, isDelete bool, valu return output, nil } + if pathIndex < 0 || pathIndex >= len(output) { + return nil, fmt.Errorf("cannot set '%d' in array: out of range", pathIndex) + } + switch typed := output[pathIndex].(type) { case map[string]interface{}: subOutput, err := overridePathInMap(typed, path[1:], isDelete, value) diff --git a/framework/override_utils_test.go b/framework/override_utils_test.go index bf5a6c9..fb7d908 100644 --- a/framework/override_utils_test.go +++ b/framework/override_utils_test.go @@ -106,6 +106,20 @@ func TestWritePathInStruct(t *testing.T) { Value: "hello", ExpectedError: fmt.Errorf("a: cannot set '2' in array: out of range"), }, + { + Name: "nested index out of range", + Spec: `{"a": [{}]}`, + Path: []string{"a", "2", "c"}, + Value: "hello", + ExpectedError: fmt.Errorf("a: cannot set '2' in array: out of range"), + }, + { + Name: "nested negative index", + Spec: `{"a": [{}]}`, + Path: []string{"a", "-1", "c"}, + Value: "hello", + ExpectedError: fmt.Errorf("a: cannot set '-1' in array: out of range"), + }, { Name: "no append nested arrays", Spec: `{"a":[[0]]}`,