Function validateFieldPath

pkg/jsonfilter/jsonfilter.go:140–150

validateFieldPath ensures the JSON field path only contains safe characters before it is concatenated into the SQL query by the ent sqljson helpers. An empty path is allowed: it targets the column itself and is not injectable.

(fieldPath string)

// before it is concatenated into the SQL query by the ent sqljson helpers.
// An empty path is allowed: it targets the column itself and is not injectable.
func validateFieldPath(fieldPath string) error {
	if fieldPath == "" {
		return nil
	}

	if !fieldPathRegexp.MatchString(fieldPath) {
		return fmt.Errorf("invalid field path %q: must be dot-separated identifiers with optional numeric array indices", fieldPath)
	}

	return nil
}