(commons-beanutils) branch master updated: Reject negative index values in DefaultResolver.getIndex (#432)

[gg...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-beanutils.git


The following commit(s) were added to refs/heads/master by this push:
     new ddc86aa1 Reject negative index values in DefaultResolver.getIndex (#432)
ddc86aa1 is described below

commit ddc86aa141e7a2d86cd4469ce0b1e05450b60742
Author: Naveed Khan <16...@users.noreply.github.com>
AuthorDate: Tue Aug 4 11:28:22 2026 +0000

    Reject negative index values in DefaultResolver.getIndex (#432)
    
    * reject negative index values in DefaultResolver.getIndex
    
    getIndex returned a parsed negative subscript unvalidated, colliding with the -1 sentinel that means the property is not indexed, so callers branching on index >= 0 wrote the whole property instead of one element.
    
    * Potential fix for pull request finding
    
    Co-authored-by: Copilot Autofix powered by AI <17...@users.noreply.github.com>
    
    ---------
    
    Co-authored-by: Gary Gregory <ga...@users.noreply.github.com>
    Co-authored-by: Copilot Autofix powered by AI <17...@users.noreply.github.com>
---
 .../org/apache/commons/beanutils2/expression/DefaultResolver.java  | 7 +++++--
 .../java/org/apache/commons/beanutils2/expression/Resolver.java    | 2 +-
 .../apache/commons/beanutils2/expression/DefaultResolverTest.java  | 6 ++++++
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/apache/commons/beanutils2/expression/DefaultResolver.java b/src/main/java/org/apache/commons/beanutils2/expression/DefaultResolver.java
index 7cb053bf..9bcbd71a 100644
--- a/src/main/java/org/apache/commons/beanutils2/expression/DefaultResolver.java
+++ b/src/main/java/org/apache/commons/beanutils2/expression/DefaultResolver.java
@@ -57,7 +57,7 @@ public class DefaultResolver implements Resolver {
      *
      * @param expression The property expression
      * @return The index value or -1 if the property is not indexed
-     * @throws IllegalArgumentException If the indexed property is illegally formed or has an invalid (non-numeric) value.
+     * @throws IllegalArgumentException If the indexed property is illegally formed or has an invalid (non-numeric or negative) value.
      */
     @Override
     public int getIndex(final String expression) {
@@ -81,7 +81,10 @@ public class DefaultResolver implements Resolver {
                 int index = 0;
                 try {
                     index = Integer.parseInt(value, 10);
-                } catch (final Exception e) {
+                } catch (final NumberFormatException e) {
+                    throw new IllegalArgumentException("Invalid index value '" + value + "'");
+                }
+                if (index < 0) {
                     throw new IllegalArgumentException("Invalid index value '" + value + "'");
                 }
                 return index;
diff --git a/src/main/java/org/apache/commons/beanutils2/expression/Resolver.java b/src/main/java/org/apache/commons/beanutils2/expression/Resolver.java
index c6b86c58..f3677995 100644
--- a/src/main/java/org/apache/commons/beanutils2/expression/Resolver.java
+++ b/src/main/java/org/apache/commons/beanutils2/expression/Resolver.java
@@ -91,7 +91,7 @@ public interface Resolver {
      *
      * @param expression The property expression
      * @return The index value or -1 if the property is not indexed
-     * @throws IllegalArgumentException If the indexed property is illegally formed or has an invalid (non-numeric) value
+     * @throws IllegalArgumentException If the indexed property is illegally formed or has an invalid (non-numeric or negative) value
      */
     int getIndex(String expression);
 
diff --git a/src/test/java/org/apache/commons/beanutils2/expression/DefaultResolverTest.java b/src/test/java/org/apache/commons/beanutils2/expression/DefaultResolverTest.java
index 4627cdd9..9a7290e4 100644
--- a/src/test/java/org/apache/commons/beanutils2/expression/DefaultResolverTest.java
+++ b/src/test/java/org/apache/commons/beanutils2/expression/DefaultResolverTest.java
@@ -105,6 +105,12 @@ class DefaultResolverTest {
         label = "Malformed";
         final IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () -> resolver.getIndex("foo[BAR]"));
         assertEquals("Invalid index value 'BAR'", e.getMessage(), label + " Error Message");
+
+        // Negative
+        label = "Negative";
+        final IllegalArgumentException negative = assertThrows(IllegalArgumentException.class, () -> resolver.getIndex("foo[-1]"));
+        assertEquals("Invalid index value '-1'", negative.getMessage(), label + " Error Message");
+        assertThrows(IllegalArgumentException.class, () -> resolver.getIndex("foo[-12]"));
     }
 
     /**