GHSA-65gg-g7rw-6cpc

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: `dasel query 'a '` panics at `selector/lexer/tokenize.go:60`. The whitespace-skip loop right above (lines 55-57) advances `p.i` to `p.srcLen` when the input is all-whitespace or whitespace-trailing. The very next line reads `p.src[p.i]` without a bounds check. ## Vulnerable code `selector/lexer/tokenize.go:53-74` (v3.11.0): ```go func (p *Tokenizer) parseCurRune() (Token, error) { // Skip over whitespace for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ } // Skip over comments if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' { // ... ``` Lines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it. ## Reproduce ``` $ echo '{"a":1}' | dasel query -i json 'a ' panic: runtime error: index out of range [2] with length 2 goroutine 1 [running]: github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).parseCurRune(...) selector/lexer/tokenize.go:60 github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Next(...) github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Tokenize(...) github.com/tomwright/dasel/v3/selector.Parse(...) github.com/tomwright/dasel/v3/execution.ExecuteSelector(...) ``` Other inputs that hit it: `' '`, `$'a\t'`, `$'a\n'`, `'a ?? '`, `'a + '`. Any token (or no token) followed by whitespace. Reachable directly from the library too - `dasel.Query(ctx, input, "a ")` panics the same way. Project-style test reproducer that fails on current `main`: ```go // drop into selector/lexer/ as tokenize_trailing_ws_test.go package lexer_test import ( "testing" "github.com/tomwright/dasel/v3/selector/lexer" ) func TestTokenize_TrailingWhitespacePanic(t *testing.T) { defer func() { if r := recover(); r != nil { t.Fatalf("Tokenize panicked: %v", r) } }() _, _ = lexer.NewTokenizer("a ").Tokenize() } ``` ## Impact Process crash, no auth, no preconditions. Same severity tier as the two May 13 advisories on this file. ## Affected versions All v3.x. The whitespace-skip loop was added in `78fcca9` (Dasel V3, ~9 months ago); line 60's indexing landed in `9bfe966` (~6 months ago). Reproduced on `github.com/tomwright/dasel/[email protected]`. ## Suggested fix One line, between the whitespace-skip loop and the comment-skip access. Same shape as lines 69-71: ```go func (p *Tokenizer) parseCurRune() (Token, error) { for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ } if p.i >= p.srcLen { return NewToken(EOF, "", p.i, 0), nil } if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' { ``` ## Prevalence The other two cases in this class shipped fixes two weeks ago; this one wasn't covered in those patches. I checked the rest of `parseCurRune` for other unguarded direct-access points after a `pos++` - nothing else stood out. A `testing.F` harness on `lexer.NewTokenizer(s).Tokenize()` catches all three with trivially short inputs and would close the class.