MIME-Version: 1.0
From: SATYANARAYANA NARLAPURAM <satyanarlapuram@gmail.com>
Date: Sat, 18 Apr 2026 09:31:03 -0700
Message-ID: 
 <CAHg+QDfdUG+6OJ5kSxmVim-UJkrtffWByLf4oftxwG7_ySYsDA@mail.gmail.com>
Subject: BUG: jsonpath .split_part() bypasses lax-mode error suppression
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Cc: florents.tselai@gmail.com, david@justatheory.com
Content-Type: multipart/mixed; boundary="00000000000030d8b0064fbe98cf"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHg%2BQDfdUG%2B6OJ5kSxmVim-UJkrtffWByLf4oftxwG7_ySYsDA%40mail.gmail.com>
Precedence: bulk

--00000000000030d8b0064fbe98cf
Content-Type: multipart/alternative; boundary="00000000000030d8ae064fbe98cd"

--00000000000030d8ae064fbe98cd
Content-Type: text/plain; charset="UTF-8"

Hi hackers,

The jsonpath string method  .split_part() bypasses lax-mode error
suppression.
This is because executeStringInternalMethod() uses
DirectFunctionCall1(numeric_int4, ...)
to convert the field number from numeric to int4. This throws
ereport(ERROR) directly,
bypassing the jspThrowErrors(cxt) / RETURN_ERROR mechanism that other
methods
like .double() use correctly.

Reproduction:
-- These should return NULL in lax mode, but throw hard ERRORs:
SELECT '"hello-world"'::jsonb @? '$.split_part("-", 99999999999)';
SELECT '"hello-world"'::jsonb @? '$.split_part("-", 0)';
ERROR:  integer out of range
ERROR:  field position must not be zero


Fix by replacing the bare DirectFunctionCall with numeric_int4_safe()
using ErrorSaveContext to catch overflow, and adding an explicit field==0
check, both gated behind RETURN_ERROR so errors are properly suppressed
in lax/silent mode while still raised in strict/non-silent mode.

Thanks,
Satya

--00000000000030d8ae064fbe98cd
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi hackers,<div><br></div><div>The jsonpath string method=
=C2=A0

.split_part() bypasses lax-mode error suppression.</div><div>This is becaus=
e executeStringInternalMethod() uses DirectFunctionCall1(numeric_int4, ...)=
<br>to convert the field number from numeric to int4. This throws ereport(E=
RROR) directly,=C2=A0</div><div>bypassing the jspThrowErrors(cxt) / RETURN_=
ERROR mechanism that other methods=C2=A0</div><div>like .double() use corre=
ctly.</div><div><br>Reproduction:</div><div>-- These should return NULL in =
lax mode, but throw hard ERRORs:<br>SELECT &#39;&quot;hello-world&quot;&#39=
;::jsonb @? &#39;$.split_part(&quot;-&quot;, 99999999999)&#39;;<br>SELECT &=
#39;&quot;hello-world&quot;&#39;::jsonb @? &#39;$.split_part(&quot;-&quot;,=
 0)&#39;;<br>ERROR: =C2=A0integer out of range<br>ERROR: =C2=A0field positi=
on must not be zero</div><div><br></div><div><br></div><div>Fix by replacin=
g the bare DirectFunctionCall with numeric_int4_safe()<br>using ErrorSaveCo=
ntext to catch overflow, and adding an explicit field=3D=3D0<br>check, both=
 gated behind RETURN_ERROR so errors are properly suppressed<br>in lax/sile=
nt mode while still raised in strict/non-silent mode.</div><div><br>Thanks,=
</div><div>Satya</div></div>

--00000000000030d8ae064fbe98cd--

--00000000000030d8b0064fbe98cf
Content-Type: application/octet-stream;
	name="0001-Fix-jsonpath-.split_part-to-respect-error-suppressio.patch"
Content-Disposition: attachment;
	filename="0001-Fix-jsonpath-.split_part-to-respect-error-suppressio.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mo4jz6ov0>
X-Attachment-Id: f_mo4jz6ov0

RnJvbSBkMWYwMDFjODFkZDA5NmNmMmY5OTQ1MzY1NzllOTk1YzRmY2ViM2RhIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBzYXR5YW5hcmF5YW5hIG5hcmxhcHVyYW0gPHNhdHlhbmFybGFw
dXJhbUBnbWFpbC5jb20+CkRhdGU6IFNhdCwgMTggQXByIDIwMjYgMTU6NDI6MTggKzAwMDAKU3Vi
amVjdDogW1BBVENIXSBGaXgganNvbnBhdGggLnNwbGl0X3BhcnQoKSB0byByZXNwZWN0IGVycm9y
IHN1cHByZXNzaW9uIGluCiBsYXggbW9kZQoKVGhlIC5zcGxpdF9wYXJ0KCkganNvbnBhdGggc3Ry
aW5nIG1ldGhvZCwgaW50cm9kdWNlZCBpbiBiZDRmODc5YSwgdXNlZApiYXJlIERpcmVjdEZ1bmN0
aW9uQ2FsbDEobnVtZXJpY19pbnQ0LCAuLi4pIHRvIGNvbnZlcnQgdGhlIGZpZWxkIG51bWJlcgph
cmd1bWVudCBmcm9tIG51bWVyaWMgdG8gaW50NC4gIFRoaXMgdGhyb3dzIGFuIHVuY2F0Y2hhYmxl
IEVSUk9SIHdoZW4gdGhlCmZpZWxkIG51bWJlciBvdmVyZmxvd3MgaW50MzIgcmFuZ2Ugb3IgaXMg
emVybywgYnlwYXNzaW5nIHRoZSBsYXgtbW9kZQplcnJvciBzdXBwcmVzc2lvbiBtZWNoYW5pc20g
dGhhdCBvdGhlciBqc29ucGF0aCBtZXRob2RzIHVzZS4KCkZvciBleGFtcGxlLCB0aGVzZSBleHBy
ZXNzaW9ucyBzaG91bGQgcmV0dXJuIE5VTEwgLyBmYWxzZSBpbiBsYXggbW9kZSwKYnV0IGluc3Rl
YWQgdGhyb3cgaGFyZCBFUlJPUnM6CgogICAgJyJoZWxsbyInOjpqc29uYiBAPyAnJC5zcGxpdF9w
YXJ0KCItIiwgOTk5OTk5OTk5OTkpJwogICAgLS0gRVJST1I6IGludGVnZXIgb3V0IG9mIHJhbmdl
IChleHBlY3RlZDogTlVMTCkKCiAgICAnImhlbGxvIic6Ompzb25iIEA/ICckLnNwbGl0X3BhcnQo
Ii0iLCAwKScKICAgIC0tIEVSUk9SOiBmaWVsZCBwb3NpdGlvbiBtdXN0IG5vdCBiZSB6ZXJvIChl
eHBlY3RlZDogTlVMTCkKCkZpeCBieSByZXBsYWNpbmcgdGhlIGJhcmUgRGlyZWN0RnVuY3Rpb25D
YWxsIHdpdGggbnVtZXJpY19pbnQ0X3NhZmUoKQp1c2luZyBFcnJvclNhdmVDb250ZXh0IHRvIGNh
dGNoIG92ZXJmbG93LCBhbmQgYWRkaW5nIGFuIGV4cGxpY2l0IGZpZWxkPT0wCmNoZWNrLCBib3Ro
IGdhdGVkIGJlaGluZCBSRVRVUk5fRVJST1Igc28gZXJyb3JzIGFyZSBwcm9wZXJseSBzdXBwcmVz
c2VkCmluIGxheC9zaWxlbnQgbW9kZSB3aGlsZSBzdGlsbCByYWlzZWQgaW4gc3RyaWN0L25vbi1z
aWxlbnQgbW9kZS4KClRoaXMgaXMgY29uc2lzdGVudCB3aXRoIGhvdyAuZG91YmxlKCkgYW5kIC5p
bnRlZ2VyKCkgaGFuZGxlIGNvbnZlcnNpb24KZXJyb3JzIHVzaW5nIEVycm9yU2F2ZUNvbnRleHQg
YW5kIFJFVFVSTl9FUlJPUi4KLS0tCiBzcmMvYmFja2VuZC91dGlscy9hZHQvanNvbnBhdGhfZXhl
Yy5jICAgICAgICB8IDE3ICsrKysrKysrLQogc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9qc29u
Yl9qc29ucGF0aC5vdXQgfCA0MCArKysrKysrKysrKysrKysrKysrKwogc3JjL3Rlc3QvcmVncmVz
cy9zcWwvanNvbmJfanNvbnBhdGguc3FsICAgICAgfCAxMSArKysrKysKIDMgZmlsZXMgY2hhbmdl
ZCwgNjcgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQoKZGlmZiAtLWdpdCBhL3NyYy9iYWNr
ZW5kL3V0aWxzL2FkdC9qc29ucGF0aF9leGVjLmMgYi9zcmMvYmFja2VuZC91dGlscy9hZHQvanNv
bnBhdGhfZXhlYy5jCmluZGV4IDBlYzliNGRmLi40MmVkM2FlYSAxMDA2NDQKLS0tIGEvc3JjL2Jh
Y2tlbmQvdXRpbHMvYWR0L2pzb25wYXRoX2V4ZWMuYworKysgYi9zcmMvYmFja2VuZC91dGlscy9h
ZHQvanNvbnBhdGhfZXhlYy5jCkBAIC03NCw2ICs3NCw3IEBACiAjaW5jbHVkZSAidXRpbHMvanNv
bi5oIgogI2luY2x1ZGUgInV0aWxzL2pzb25wYXRoLmgiCiAjaW5jbHVkZSAidXRpbHMvbWVtdXRp
bHMuaCIKKyNpbmNsdWRlICJ1dGlscy9udW1lcmljLmgiCiAjaW5jbHVkZSAidXRpbHMvdGltZXN0
YW1wLmgiCiAKIC8qCkBAIC0zMDE4LDYgKzMwMTksOCBAQCBleGVjdXRlU3RyaW5nSW50ZXJuYWxN
ZXRob2QoSnNvblBhdGhFeGVjQ29udGV4dCAqY3h0LCBKc29uUGF0aEl0ZW0gKmpzcCwKIAkJCXsK
IAkJCQljaGFyCSAgICpmcm9tX3N0cjsKIAkJCQlOdW1lcmljCQluOworCQkJCWludDMyCQlmaWVs
ZDsKKwkJCQlFcnJvclNhdmVDb250ZXh0IGVzY29udGV4dCA9IHtUX0Vycm9yU2F2ZUNvbnRleHR9
OwogCiAJCQkJanNwR2V0TGVmdEFyZyhqc3AsICZlbGVtKTsKIAkJCQlpZiAoZWxlbS50eXBlICE9
IGpwaVN0cmluZykKQEAgLTMwMzEsMTEgKzMwMzQsMjMgQEAgZXhlY3V0ZVN0cmluZ0ludGVybmFs
TWV0aG9kKEpzb25QYXRoRXhlY0NvbnRleHQgKmN4dCwgSnNvblBhdGhJdGVtICpqc3AsCiAKIAkJ
CQluID0ganNwR2V0TnVtZXJpYygmZWxlbSk7CiAKKwkJCQlmaWVsZCA9IG51bWVyaWNfaW50NF9z
YWZlKG4sIChOb2RlICopICZlc2NvbnRleHQpOworCQkJCWlmIChlc2NvbnRleHQuZXJyb3Jfb2Nj
dXJyZWQpCisJCQkJCVJFVFVSTl9FUlJPUihlcmVwb3J0KEVSUk9SLAorCQkJCQkJCQkJCSAoZXJy
Y29kZShFUlJDT0RFX0lOVkFMSURfUEFSQU1FVEVSX1ZBTFVFKSwKKwkJCQkJCQkJCQkgIGVycm1z
ZygianNvbnBhdGggaXRlbSBtZXRob2QgLiVzKCkgZmllbGQgbnVtYmVyIGlzIG91dCBvZiByYW5n
ZSBmb3IgdHlwZSBpbnRlZ2VyIiwKKwkJCQkJCQkJCQkJCSBqc3BPcGVyYXRpb25OYW1lKGpzcC0+
dHlwZSkpKSkpOworCisJCQkJaWYgKGZpZWxkID09IDApCisJCQkJCVJFVFVSTl9FUlJPUihlcmVw
b3J0KEVSUk9SLAorCQkJCQkJCQkJCSAoZXJyY29kZShFUlJDT0RFX0lOVkFMSURfUEFSQU1FVEVS
X1ZBTFVFKSwKKwkJCQkJCQkJCQkgIGVycm1zZygiZmllbGQgcG9zaXRpb24gbXVzdCBub3QgYmUg
emVybyIpKSkpOworCiAJCQkJcmVzU3RyID0gVGV4dERhdHVtR2V0Q1N0cmluZyhEaXJlY3RGdW5j
dGlvbkNhbGwzQ29sbChzcGxpdF9wYXJ0LAogCQkJCQkJCQkJCQkJCQkJCQkgREVGQVVMVF9DT0xM
QVRJT05fT0lELAogCQkJCQkJCQkJCQkJCQkJCQkgc3RyLAogCQkJCQkJCQkJCQkJCQkJCQkgQ1N0
cmluZ0dldFRleHREYXR1bShmcm9tX3N0ciksCi0JCQkJCQkJCQkJCQkJCQkJCSBEaXJlY3RGdW5j
dGlvbkNhbGwxKG51bWVyaWNfaW50NCwgTnVtZXJpY0dldERhdHVtKG4pKSkpOworCQkJCQkJCQkJ
CQkJCQkJCQkgSW50MzJHZXREYXR1bShmaWVsZCkpKTsKIAkJCQlicmVhazsKIAkJCX0KIAkJZGVm
YXVsdDoKZGlmZiAtLWdpdCBhL3NyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0ZWQvanNvbmJfanNvbnBh
dGgub3V0IGIvc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9qc29uYl9qc29ucGF0aC5vdXQKaW5k
ZXggYWZhNmM0Y2IuLjE0YzEzNTkyIDEwMDY0NAotLS0gYS9zcmMvdGVzdC9yZWdyZXNzL2V4cGVj
dGVkL2pzb25iX2pzb25wYXRoLm91dAorKysgYi9zcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL2pz
b25iX2pzb25wYXRoLm91dApAQCAtMzA3Myw2ICszMDczLDQ2IEBAIHNlbGVjdCBqc29uYl9wYXRo
X3F1ZXJ5KCciYWJjLGRlZixnaGksamtsIicsICckLnNwbGl0X3BhcnQoIiwiLCAtMiknKTsKICAi
Z2hpIgogKDEgcm93KQogCistLSBUZXN0IC5zcGxpdF9wYXJ0KCkgZXJyb3IgaGFuZGxpbmcgaW4g
bGF4IG1vZGUgKHNob3VsZCBzdXBwcmVzcyBlcnJvcnMpCitzZWxlY3QganNvbmIgJyJoZWxsby13
b3JsZCInIEA/ICckLnNwbGl0X3BhcnQoIi0iLCAwKSc7CisgP2NvbHVtbj8gCistLS0tLS0tLS0t
CisgCisoMSByb3cpCisKK3NlbGVjdCBqc29uYiAnImhlbGxvLXdvcmxkIicgQD8gJyQuc3BsaXRf
cGFydCgiLSIsIDk5OTk5OTk5OTk5KSc7CisgP2NvbHVtbj8gCistLS0tLS0tLS0tCisgCisoMSBy
b3cpCisKK3NlbGVjdCBqc29uYl9wYXRoX2V4aXN0cygnImhlbGxvLXdvcmxkIicsICckLnNwbGl0
X3BhcnQoIi0iLCAwKScsIHNpbGVudCA9PiB0cnVlKTsKKyBqc29uYl9wYXRoX2V4aXN0cyAKKy0t
LS0tLS0tLS0tLS0tLS0tLS0KKyAKKygxIHJvdykKKworc2VsZWN0IGpzb25iX3BhdGhfZXhpc3Rz
KCciaGVsbG8td29ybGQiJywgJyQuc3BsaXRfcGFydCgiLSIsIDk5OTk5OTk5OTk5KScsIHNpbGVu
dCA9PiB0cnVlKTsKKyBqc29uYl9wYXRoX2V4aXN0cyAKKy0tLS0tLS0tLS0tLS0tLS0tLS0KKyAK
KygxIHJvdykKKworc2VsZWN0IGpzb25iX3BhdGhfcXVlcnkoJyJoZWxsby13b3JsZCInLCAnJC5z
cGxpdF9wYXJ0KCItIiwgMCknLCBzaWxlbnQgPT4gdHJ1ZSk7CisganNvbmJfcGF0aF9xdWVyeSAK
Ky0tLS0tLS0tLS0tLS0tLS0tLQorKDAgcm93cykKKworc2VsZWN0IGpzb25iX3BhdGhfcXVlcnko
JyJoZWxsby13b3JsZCInLCAnJC5zcGxpdF9wYXJ0KCItIiwgOTk5OTk5OTk5OTkpJywgc2lsZW50
ID0+IHRydWUpOworIGpzb25iX3BhdGhfcXVlcnkgCistLS0tLS0tLS0tLS0tLS0tLS0KKygwIHJv
d3MpCisKKy0tIFRoZXNlIHNob3VsZCBzdGlsbCBlcnJvciBpbiBzdHJpY3Qvbm9uLXNpbGVudCBt
b2RlCitzZWxlY3QganNvbmJfcGF0aF9xdWVyeSgnImhlbGxvLXdvcmxkIicsICckLnNwbGl0X3Bh
cnQoIi0iLCAwKScpOworRVJST1I6ICBmaWVsZCBwb3NpdGlvbiBtdXN0IG5vdCBiZSB6ZXJvCitz
ZWxlY3QganNvbmJfcGF0aF9xdWVyeSgnImhlbGxvLXdvcmxkIicsICckLnNwbGl0X3BhcnQoIi0i
LCA5OTk5OTk5OTk5OSknKTsKK0VSUk9SOiAganNvbnBhdGggaXRlbSBtZXRob2QgLnNwbGl0X3Bh
cnQoKSBmaWVsZCBudW1iZXIgaXMgb3V0IG9mIHJhbmdlIGZvciB0eXBlIGludGVnZXIKIC0tIFRl
c3Qgc3RyaW5nIG1ldGhvZHMgcGxheSBuaWNlbHkgdG9nZXRoZXIKIHNlbGVjdCBqc29uYl9wYXRo
X3F1ZXJ5KCciaGVsbG8gd29ybGQiJywgJyQucmVwbGFjZSgiaGVsbG8iLCJieWUiKS51cHBlcigp
Jyk7CiAganNvbmJfcGF0aF9xdWVyeSAKZGlmZiAtLWdpdCBhL3NyYy90ZXN0L3JlZ3Jlc3Mvc3Fs
L2pzb25iX2pzb25wYXRoLnNxbCBiL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL2pzb25iX2pzb25wYXRo
LnNxbAppbmRleCBkM2EzOGM1Ny4uYjllMTg5YTAgMTAwNjQ0Ci0tLSBhL3NyYy90ZXN0L3JlZ3Jl
c3Mvc3FsL2pzb25iX2pzb25wYXRoLnNxbAorKysgYi9zcmMvdGVzdC9yZWdyZXNzL3NxbC9qc29u
Yl9qc29ucGF0aC5zcWwKQEAgLTcyMiw2ICs3MjIsMTcgQEAgc2VsZWN0IGpzb25iX3BhdGhfcXVl
cnkoJyJoZWxsbyB3b3JsZCInLCAnJC5yZXBsYWNlKCJoZWxsbyIsImJ5ZSIpIHN0YXJ0cyB3aXRo
ICIKIHNlbGVjdCBqc29uYl9wYXRoX3F1ZXJ5KCciYWJjfkB+ZGVmfkB+Z2hpIicsICckLnNwbGl0
X3BhcnQoIn5AfiIsIDIpJyk7CiBzZWxlY3QganNvbmJfcGF0aF9xdWVyeSgnImFiYyxkZWYsZ2hp
LGprbCInLCAnJC5zcGxpdF9wYXJ0KCIsIiwgLTIpJyk7CiAKKy0tIFRlc3QgLnNwbGl0X3BhcnQo
KSBlcnJvciBoYW5kbGluZyBpbiBsYXggbW9kZSAoc2hvdWxkIHN1cHByZXNzIGVycm9ycykKK3Nl
bGVjdCBqc29uYiAnImhlbGxvLXdvcmxkIicgQD8gJyQuc3BsaXRfcGFydCgiLSIsIDApJzsKK3Nl
bGVjdCBqc29uYiAnImhlbGxvLXdvcmxkIicgQD8gJyQuc3BsaXRfcGFydCgiLSIsIDk5OTk5OTk5
OTk5KSc7CitzZWxlY3QganNvbmJfcGF0aF9leGlzdHMoJyJoZWxsby13b3JsZCInLCAnJC5zcGxp
dF9wYXJ0KCItIiwgMCknLCBzaWxlbnQgPT4gdHJ1ZSk7CitzZWxlY3QganNvbmJfcGF0aF9leGlz
dHMoJyJoZWxsby13b3JsZCInLCAnJC5zcGxpdF9wYXJ0KCItIiwgOTk5OTk5OTk5OTkpJywgc2ls
ZW50ID0+IHRydWUpOworc2VsZWN0IGpzb25iX3BhdGhfcXVlcnkoJyJoZWxsby13b3JsZCInLCAn
JC5zcGxpdF9wYXJ0KCItIiwgMCknLCBzaWxlbnQgPT4gdHJ1ZSk7CitzZWxlY3QganNvbmJfcGF0
aF9xdWVyeSgnImhlbGxvLXdvcmxkIicsICckLnNwbGl0X3BhcnQoIi0iLCA5OTk5OTk5OTk5OSkn
LCBzaWxlbnQgPT4gdHJ1ZSk7CistLSBUaGVzZSBzaG91bGQgc3RpbGwgZXJyb3IgaW4gc3RyaWN0
L25vbi1zaWxlbnQgbW9kZQorc2VsZWN0IGpzb25iX3BhdGhfcXVlcnkoJyJoZWxsby13b3JsZCIn
LCAnJC5zcGxpdF9wYXJ0KCItIiwgMCknKTsKK3NlbGVjdCBqc29uYl9wYXRoX3F1ZXJ5KCciaGVs
bG8td29ybGQiJywgJyQuc3BsaXRfcGFydCgiLSIsIDk5OTk5OTk5OTk5KScpOworCiAtLSBUZXN0
IHN0cmluZyBtZXRob2RzIHBsYXkgbmljZWx5IHRvZ2V0aGVyCiBzZWxlY3QganNvbmJfcGF0aF9x
dWVyeSgnImhlbGxvIHdvcmxkIicsICckLnJlcGxhY2UoImhlbGxvIiwiYnllIikudXBwZXIoKScp
Owogc2VsZWN0IGpzb25iX3BhdGhfcXVlcnkoJyJoRWxMbyBXb3JsRCInLCAnJC5sb3dlcigpLnVw
cGVyKCkubG93ZXIoKS5yZXBsYWNlKCJoZWxsbyIsImJ5ZSIpJyk7Ci0tIAoyLjQzLjAKCg==
--00000000000030d8b0064fbe98cf--