Migrate from jsonpath to jsonpath-plus (#4811)

Author: fiskus

catalog/CHANGELOG.md

@@ -18,6 +18,7 @@ where verb is one of
 
 ## Changes
 
+- [Changed] Replace `jsonpath` with `jsonpath-plus` for JSONPath evaluation ([#4811](https://github.com/quiltdata/quilt/pull/4811))
 - [Fixed] Fix "Error resolving revision" flash when navigating to a just-created package ([#4778](https://github.com/quiltdata/quilt/pull/4778))
 - [Changed] Qurator: Switch to Claude Sonnet 4.5, add `quratorDefaultModel` config field for per-stack model override ([#4764](https://github.com/quiltdata/quilt/pull/4764))
 - [Fixed] Fix crash when deleting a role on the admin page ([#4751](https://github.com/quiltdata/quilt/pull/4751))

catalog/app/components/FileEditor/QuiltConfigEditor/BucketPreferences/PackageDescription.tsx

@@ -1,10 +1,10 @@
 import cx from 'classnames'
-import jsonpath from 'jsonpath'
 import React from 'react'
 import * as M from '@material-ui/core'
 import * as Lab from '@material-ui/lab'
 
 import type { PackagePreferencesInput } from 'utils/BucketPreferences/BucketPreferences'
+import * as jsonpath from 'utils/jsonpath'
 
 import type { KeyedValue } from './State'
 

catalog/app/utils/jsonpath.spec.ts

@@ -0,0 +1,77 @@
+import { describe, expect, it } from 'vitest'
+
+import { parse } from './jsonpath'
+
+describe('utils/jsonpath', () => {
+  describe('parse', () => {
+    it('should accept dot-notation child access', () => {
+      expect(() => parse('$.store.book')).not.toThrow()
+    })
+
+    it('should accept wildcard subscript', () => {
+      expect(() => parse('$.store.book[*].author')).not.toThrow()
+    })
+
+    it('should accept recursive descent', () => {
+      expect(() => parse('$..author')).not.toThrow()
+    })
+
+    it('should accept wildcard member', () => {
+      expect(() => parse('$.store.*')).not.toThrow()
+    })
+
+    it('should accept recursive descent with member', () => {
+      expect(() => parse('$.store..price')).not.toThrow()
+    })
+
+    it('should accept numeric array index', () => {
+      expect(() => parse('$..book[2]')).not.toThrow()
+    })
+
+    it('should accept script subscript expression', () => {
+      expect(() => parse('$..book[(@.length-1)]')).not.toThrow()
+    })
+
+    it('should accept negative slice', () => {
+      expect(() => parse('$..book[-1:]')).not.toThrow()
+    })
+
+    it('should accept union of indices', () => {
+      expect(() => parse('$..book[0,1]')).not.toThrow()
+    })
+
+    it('should accept array slice', () => {
+      expect(() => parse('$..book[:2]')).not.toThrow()
+    })
+
+    it('should accept filter expression with existence check', () => {
+      expect(() => parse('$..book[?(@.isbn)]')).not.toThrow()
+    })
+
+    it('should accept filter expression with comparison', () => {
+      expect(() => parse('$..book[?(@.price<10)]')).not.toThrow()
+    })
+
+    it('should accept recursive wildcard', () => {
+      expect(() => parse('$..*')).not.toThrow()
+    })
+
+    it('should reject plain text', () => {
+      expect(() => parse('not a path')).toThrow()
+    })
+
+    it('should reject empty string', () => {
+      expect(() => parse('')).toThrow()
+    })
+
+    // Goessner spec does not allow `}` in expressions, but jsonpath-plus
+    // silently accepts malformed bracket contents via toPathArray.
+    it('should not reject malformed brackets (spec deviation)', () => {
+      expect(() => parse('$[}}}')).not.toThrow()
+    })
+
+    it('should reject expression missing root', () => {
+      expect(() => parse('[invalid')).toThrow()
+    })
+  })
+})

catalog/app/utils/jsonpath.ts

@@ -0,0 +1,14 @@
+import { JSONPath } from 'jsonpath-plus'
+
+// Thin wrapper around jsonpath-plus.
+//
+// jsonpath-plus is more permissive than the Goessner spec
+// (https://goessner.net/articles/JsonPath/), so we add guards
+// to reject expressions that the spec considers invalid.
+
+export function parse(expr: string) {
+  if (!expr) throw new SyntaxError(`Invalid JSONPath: ${expr}`)
+  const parts = JSONPath.toPathArray(expr)
+  if (parts[0] !== '$') throw new SyntaxError(`Invalid JSONPath: ${expr}`)
+  return parts
+}