Array path helpers accept malformed RFC 6902 indexes
Author: simonyang08Created Aug 21, 2026Updated Aug 21, 2026
Reproduction
const data = { items: ["a", "b", "c"] };
getByPath(data, "/items/1foo"); // "b"
setByPath(data, "/items/01", "x"); // writes index 1
addByPath(data, "/items/1.5", "x"); // inserts at index 1
removeByPath(data, "/items/-1"); // may address a non-index array propertyThe state-store path setter has the same parsing behavior.
Expected behavior
When the current container is an array, path tokens should follow the RFC 6902 array-index grammar: 0 or a non-zero digit followed by digits. Partial numeric strings, leading zeros, decimals, negative values, and integers that cannot be represented safely should be rejected rather than coerced with parseInt.
Object member names should remain unrestricted, including numeric-looking keys.
Proposed fix
Use strict, safe-integer parsing only while traversing arrays, preserve object-key behavior, and add regression coverage for mutable path helpers and state-store writes.
I have a focused patch ready with regression tests.
Source: vercel-labs/json-render