{"record":{"id":"a596c2224f45be07","repo":"payloadcms/payload","slug":"invalid-field-path-a596c2","errorCode":null,"errorMessage":"Invalid field path.","messagePattern":"Invalid field path\\.","errorType":"validation","errorClass":"APIError","httpStatus":400,"severity":"error","filePath":"packages/plugin-import-export/src/utilities/setNestedValue.ts","lineNumber":34,"sourceCode":"  return Number.isSafeInteger(index) && index >= 0\n}\n\nconst getPathKey = (\n  target: Record<string, unknown> | unknown[],\n  part: string,\n  source: unknown,\n): number | string => {\n  if (!Array.isArray(target) || !isArrayIndex(part)) {\n    return part\n  }\n\n  const index = Number(part)\n\n  if (\n    (Array.isArray(source) && index >= source.length) ||\n    (!Array.isArray(source) && index > target.length + MAX_UNVERIFIED_SPARSE_ARRAY_GAP)\n  ) {\n    throw new APIError('Invalid field path.', 400, null, true)\n  }\n\n  return index\n}\n\nconst getSourceValue = (source: unknown, part: string): unknown => {\n  if (source === null || typeof source !== 'object') {\n    return undefined\n  }\n\n  const key = Array.isArray(source) && isArrayIndex(part) ? Number(part) : part\n\n  return (source as Record<number | string, unknown>)[key]\n}\n\n/**\n * Sets a value deeply into a nested object or array, based on a dot-notation path.\n *","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/plugin-import-export/src/utilities/setNestedValue.ts#L16-L52","documentation":"In setNestedValue, getPathKey validates array indices. It throws APIError 'Invalid field path.' when an index is out of bounds: if a source array is provided and index >= source.length, or without a source when index > target.length + 1 (MAX_UNVERIFIED_SPARSE_ARRAY_GAP). This prevents creating huge sparse arrays from untrusted paths.","triggerScenarios":"A dot path like 'items.999.field' where the source array is short (index >= source.length), or a large index with no source to validate against (exceeds the allowed sparse gap).","commonSituations":"Reconstructing nested objects from flattened CSV rows with array fields; untrusted path input with arbitrary indices; mismatch between source array length and the target path.","solutions":["Validate array indices against the source array length before building the path.","Reject/normalize indices that exceed target.length + 1 when no source is available.","Sanitize untrusted paths to clamp out-of-range indices."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function assertPathWithinSource(path: string, source: unknown) {\n  const parts = path.split('.')\n  let cur: unknown = source\n  for (const p of parts) {\n    if (Array.isArray(cur) && /^\\d+$/.test(p) && Number(p) >= cur.length) {\n      throw new Error(`Array index ${p} out of bounds (len ${cur.length})`)\n    }\n    cur = Array.isArray(cur) || (cur && typeof cur === 'object') ? (cur as Record<string, unknown>)?.[p] : undefined\n  }\n}","typeGuard":"const isWithinArrayBounds = (index: number, source: unknown): boolean =>\n  !Array.isArray(source) || index < source.length","tryCatchPattern":null,"preventionTips":["Validate array indices against the source array length before building paths.","Clamp or reject indices beyond target.length + 1 when no source exists.","Treat reconstructed paths from untrusted input as untrusted."],"tags":["validation","arrays","security","plugin-import-export"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}