From 398fda6c9a00aea08f75249cdf7430b4d74e81b9 Mon Sep 17 00:00:00 2001 From: simonfaltum Date: Tue, 9 Jun 2026 22:02:14 +0200 Subject: [PATCH 1/2] Fix panic on empty --json flag value JsonFlag.Set indexed v[0] without a length check, so an empty value (for example from an unset shell variable) crashed the CLI with an index out of range panic. Return a validation error instead. Co-authored-by: Isaac --- libs/flags/json_flag.go | 5 +++++ libs/flags/json_flag_test.go | 7 +++++++ 2 files changed, 12 insertions(+) diff --git a/libs/flags/json_flag.go b/libs/flags/json_flag.go index 8a50e6c092b..0866030c33b 100644 --- a/libs/flags/json_flag.go +++ b/libs/flags/json_flag.go @@ -2,6 +2,7 @@ package flags import ( "encoding/json" + "errors" "fmt" "os" "reflect" @@ -23,6 +24,10 @@ func (j *JsonFlag) String() string { // TODO: Command.MarkFlagFilename() func (j *JsonFlag) Set(v string) error { + // Reject empty input (e.g. --json "$EMPTY_VAR") instead of panicking on v[0] below. + if v == "" { + return errors.New("expected inline JSON or @path/to/file, got an empty string") + } // Load request from file if it starts with '@' (like curl). if v[0] != '@' { j.raw = []byte(v) diff --git a/libs/flags/json_flag_test.go b/libs/flags/json_flag_test.go index 2ebda9f8678..db9eaa78819 100644 --- a/libs/flags/json_flag_test.go +++ b/libs/flags/json_flag_test.go @@ -24,6 +24,13 @@ func TestJsonFlagEmpty(t *testing.T) { assert.Nil(t, request) } +func TestJsonFlagEmptyValue(t *testing.T) { + var body JsonFlag + + err := body.Set("") + assert.EqualError(t, err, "expected inline JSON or @path/to/file, got an empty string") +} + func TestJsonFlagInline(t *testing.T) { var body JsonFlag From 74c1e4ce3a618dbb1fa8f35d3f70cfae6396029b Mon Sep 17 00:00:00 2001 From: simonfaltum Date: Wed, 10 Jun 2026 00:08:02 +0200 Subject: [PATCH 2/2] Remove redundant comments Co-authored-by: Isaac --- libs/flags/json_flag.go | 1 - 1 file changed, 1 deletion(-) diff --git a/libs/flags/json_flag.go b/libs/flags/json_flag.go index 0866030c33b..587bca298c3 100644 --- a/libs/flags/json_flag.go +++ b/libs/flags/json_flag.go @@ -24,7 +24,6 @@ func (j *JsonFlag) String() string { // TODO: Command.MarkFlagFilename() func (j *JsonFlag) Set(v string) error { - // Reject empty input (e.g. --json "$EMPTY_VAR") instead of panicking on v[0] below. if v == "" { return errors.New("expected inline JSON or @path/to/file, got an empty string") }