Array path helpers accept malformed RFC 6902 indexes

Author: simonyang08Created Aug 21, 2026Updated Aug 21, 2026

Reproduction

typescript
const data = { items: ["a", "b", "c"] };

getByPath(data, "/items/1foo"); // "b"
setByPath(data, "/items/01", "x"); // writes index 1
addByPath(data, "/items/1.5", "x"); // inserts at index 1
removeByPath(data, "/items/-1"); // may address a non-index array property

The state-store path setter has the same parsing behavior.

Expected behavior

When the current container is an array, path tokens should follow the RFC 6902 array-index grammar: 0 or a non-zero digit followed by digits. Partial numeric strings, leading zeros, decimals, negative values, and integers that cannot be represented safely should be rejected rather than coerced with parseInt.

Object member names should remain unrestricted, including numeric-looking keys.

Proposed fix

Use strict, safe-integer parsing only while traversing arrays, preserve object-key behavior, and add regression coverage for mutable path helpers and state-store writes.

I have a focused patch ready with regression tests.