itchyny 9d223f153c Reject embedded NUL bytes in module import paths ...

jq accepts embedded NUL bytes at the language level but resolves
module import paths through NUL-terminated C strings, so the path
validated by policy or audit code could differ from the on-disk
path jq actually opens. Pass jv through gen_import so the AST
preserves the original bytes, and reject embedded NULs in
validate_relpath.

Fixes CVE-2026-43895.

2026-05-09 17:08:43 +09:00

..

modules

…

torture

…

base64.test

Improve error message truncation with closing delimiters (#3478)

2026-02-25 08:14:23 +09:00

base64test

…

jq_fuzz_compile.c

…

jq_fuzz_execute.cpp

jq_fuzz_execute: limit oniguruma depth to 1024 (#3377)

2025-10-05 12:50:42 +09:00

jq_fuzz_fixed.cpp

…

jq_fuzz_load_file.c

…

jq_fuzz_parse_extended.c

…

jq_fuzz_parse_stream.c

fix jq_fuzz_parse_stream: use iterative parser API for streaming mode (#3499)

2026-03-11 11:49:14 +09:00

jq_fuzz_parse.c

…

jq-f-test.sh

…

jq.test

Limit recursive object merge depth to prevent stack overflow

2026-05-05 22:44:02 +09:00

jqtest

…

local.supp

…

man.test

Add trimstr/1 function (#3319)

2025-05-21 18:46:04 +09:00

manonig.test

…

manonigtest

…

mantest

…

no-main-program.jq

…

onig.supp

…

onig.test

…

onigtest

…

optional.test

Fix portability of strptime especially for Windows (#3342)

2025-06-14 08:00:55 +09:00

optionaltest

…

setup

…

shtest

Reject embedded NUL bytes in module import paths

2026-05-09 17:08:43 +09:00

uri.test

Refactor @uri and @urid and fix multi-byte UTF-8 corruption (#3495)

2026-03-05 08:28:09 +09:00

uritest

…

utf8test

Fix slurping raw input not to corrupt multi-byte characters (fix #3389) (#3421)

2025-10-31 15:16:29 +09:00

yes-main-program.jq

…