jsonpatch-js

jsonpatch-js copied to clipboard

The code is vulnerable to prototype pollution, because it allows patching `__proto__`. This can be escalated to remote code execution if user-supplied input is passed as the patch list: ```js...

alxbrsn

The `error.stack` property is missing. Looks like CoffeeScript's "inheritance" just sets the prototype and the constructor does not contain a `super()` call, so the native constructor of `Error` is never...

felixfbecker

`new jsonpatch.JSONPointer("/x").getReference({x:123})` returns {x:123} instead of 123

nebulaszlonemethi

Removes are completed sequentially, leading to unexpected results.

3

Example: ``` {"mydata": ["apple", "orange","pear", "lemon"]} ``` With the following operation: ``` [{"op":"remove","path":"/mydata/0"},{"op":"remove","path":"/mydata/2"}] ``` The result is: ``` { "mydata": ["orange","pear"] } ``` Rather than the expected: ``` { "mydata":...

jonkeegan

plans on having a declarative wrapper?

1

Any plans on doing a declarative wrapper around this? If not, would you be interested in me making a contrib?

0xgeert

PATCH request should be atomic

1

Per HTTP PATCH spec ``` Note that the HTTP PATCH method is atomic, as per [RFC5789]. Therefore, the following patch would result in no changes being made to the document...

risseraka