GHSA-65gg-g7rw-6cpc: Out-of-bounds Read
Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: dasel query 'a ' panics at selector/lexer/tokenize.go:60.
The whitespace-skip loop right above (lines 55-57) advances p.i to p.srcLen when the input is all-whitespace or whitespace-trailing. The very next line reads p.src[p.i] without a bounds check.
Vulnerable code
selector/lexer/tokenize.go:53-74 (v3.11.0):
go func (p Tokenizer) parseCurRune() (Token, error) { // Skip over whitespace for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ }
// Skip over comments if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' { // ...
Lines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it.
Reproduce
$ echo '{"a":1}' | dasel query -i json 'a ' panic: runtime error: index out of range [2] with length 2
goroutine 1 [running]: github.com/tomwright/dasel/v3/selector/lexer.(Tokenizer).parseCurRune(...) selector/lexer/tokenize.go:60 github.com/tomwright/dasel/v3/selector/lexer.(Tokenizer).Next(...) github.com/tomwright/dasel/v3/selector/lexer.(Tokenizer).Tokenize(...) github.com/tomwright/dasel/v3/selector.Parse(...) github.com/tomwright/dasel/v3/execution.ExecuteSelector(...)
Other inputs that hit it: ' ', $'a\t', $'a\n', 'a ?? ', 'a + '. Any token (or no token) followed by whitespace.
Reachable directly from the library too - dasel.Query(ctx, input, "a ") panics the same way. Project-style test reproducer that fails on current main:
go // drop into selector/lexer/ as tokenizetrailingwstest.go package lexertest
import ( "testing" "github.com/tomwright/dasel/v3/selector/lexer" )
func TestTokenizeTrailingWhitespacePanic(t testing.T) { defer func() { if r := recover(); r != nil { t.Fatalf("Tokenize panicked: %v", r) } }() , = lexer.NewTokenizer("a ").Tokenize() }
Impact
Process crash, no auth, no preconditions. Same severity tier as the two May 13 advisories on this file.
Affected versions
All v3.x. The whitespace-skip loop was added in 78fcca9 (Dasel V3, ~9 months ago); line 60's indexing landed in 9bfe966 (~6 months ago). Reproduced on github.com/tomwright/dasel/v3@v3.11.0.
Suggested fix
One line, between the whitespace-skip loop and the comment-skip access. Same shape as lines 69-71:
go func (p Tokenizer) parseCurRune() (Token, error) { for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ }
if p.i >= p.srcLen { return NewToken(EOF, "", p.i, 0), nil }
if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' {
Prevalence
The other two cases in this class shipped fixes two weeks ago; this one wasn't covered in those patches. I checked the rest of parseCurRune for other unguarded direct-access points after a pos++ - nothing else stood out. A testing.F harness on lexer.NewTokenizer(s).Tokenize() catches all three with trivially short inputs and would close the class.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/tomwright/dasel/v3to a version that resolves this vulnerability.Fixed in 3.11.2 - Compensating control
In selector/lexer/tokenize.go, after the whitespace-skipping loop in parseCurRune and before accessing p.src[p.i] for comment detection, add a bounds check for p.i >= p.srcLen and return EOF to prevent panics on selectors ending in whitespace.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or systems that invoke dasel with selector input are exposed if an untrusted party can control or influence the selector. The issue can also be triggered during normal local command-line use with a selector that ends in whitespace.
What does an attacker need to trigger the failure?
The attacker only needs to supply a selector ending in whitespace, such as `a `. No authentication, user interaction, or specially crafted input document is required.
What is the impact of successful exploitation?
Triggering the flaw causes dasel to panic due to an out-of-bounds read in the selector tokenizer. This can terminate the affected process and create a denial-of-service condition.
How can I tell whether I am affected?
Run a query using a selector with trailing whitespace, for example `echo '{"a":1}' | dasel query -i json 'a '`. A vulnerable installation panics with an index-out-of-range error referring to `selector/lexer/tokenize.go:60`.
What can be done if patching is not immediately possible?
Reject or trim trailing whitespace from selectors before passing them to dasel. Avoid allowing untrusted users to provide selectors until the issue is remediated.