nexu-io/open-design · error

${field} contains unsupported JSON path segment: ${segment}

Error message

${field} contains unsupported JSON path segment: ${segment}

What it means

parseMappingPath (refresh.ts:284-289) checks each dot-separated segment against SAFE_MAPPING_SEGMENT (an identifier `[A-Za-z_][A-Za-z0-9_-]*` or a non-negative integer `0|[1-9][0-9]*`) and rejects prototype-pollution keys (__proto__, prototype, constructor). Any segment that fails either test throws this error.

Source

Thrown at apps/daemon/src/live-artifacts/refresh.ts:287

  if (!result.ok) {
    const firstIssue = result.issues[0];
    throw new Error(firstIssue === undefined ? result.error : `${firstIssue.path}: ${firstIssue.message}`);
  }
  return result.value;
}

const SAFE_MAPPING_SEGMENT = /^[A-Za-z_][A-Za-z0-9_-]*$|^(?:0|[1-9][0-9]*)$/;
const UNSAFE_MAPPING_SEGMENTS = new Set(['__proto__', 'prototype', 'constructor']);

function parseMappingPath(path: string, field: string): string[] {
  const normalized = path.startsWith('$.') ? path.slice(2) : path;
  if (normalized.length === 0 || normalized.startsWith('.') || normalized.endsWith('.') || normalized.includes('..')) {
    throw new Error(`${field} must be a dot-separated JSON path`);
  }
  const segments = normalized.split('.');
  for (const segment of segments) {
    if (!SAFE_MAPPING_SEGMENT.test(segment) || UNSAFE_MAPPING_SEGMENTS.has(segment)) {
      throw new Error(`${field} contains unsupported JSON path segment: ${segment}`);
    }
  }
  return segments;
}

function isJsonObject(value: BoundedJsonValue | undefined): value is BoundedJsonObject {
  return value !== null && typeof value === 'object' && !Array.isArray(value);
}

function readMappedValue(root: BoundedJsonObject, path: string): BoundedJsonValue | undefined {
  let current: BoundedJsonValue | undefined = root;
  for (const segment of parseMappingPath(path, 'outputMapping.dataPaths.from')) {
    if (Array.isArray(current)) {
      const index = Number(segment);
      if (!Number.isSafeInteger(index) || index < 0) throw new Error(`outputMapping.dataPaths.from array segment is invalid: ${segment}`);
      current = current[index];
    } else if (isJsonObject(current)) {
      current = current[segment];

View on GitHub (pinned to 5be4028344)

Solutions

1. Convert bracket notation to dotted numeric segments: 'items[0]' -> 'items.0'.
2. Remove spaces and special characters from path segments; use only letters, digits, underscore, and hyphen.
3. Never allow user-controlled __proto__/prototype/constructor segments; sanitize inputs upstream.

Example fix

// before
outputMapping: { dataPaths: [{ from: 'rows[0].name', to: 'result' }] }
// throws `outputMapping.dataPaths.from contains unsupported JSON path segment: rows[0]`

// after
outputMapping: { dataPaths: [{ from: 'rows.0.name', to: 'result' }] }

const SAFE = /^[A-Za-z_][A-Za-z0-9_-]*$|^(?:0|[1-9][0-9]*)$/;
const FORBIDDEN = new Set(['__proto__', 'prototype', 'constructor']);
function isSafeSegment(seg: string): boolean {
  return SAFE.test(seg) && !FORBIDDEN.has(seg);
}
function isSafeDataPath(p: string): boolean {
  const norm = p.startsWith('$.') ? p.slice(2) : p;
  return norm.split('.').every(isSafeSegment);
}

function isSafeMappingPath(p: unknown): p is string {
  if (typeof p !== 'string') return false;
  const norm = p.startsWith('$.') ? p.slice(2) : p;
  return norm.split('.').every((s) => SAFE.test(s) && !FORBIDDEN.has(s));
}

When it happens

Trigger: A dataPath segment contains characters outside the safe set (spaces, brackets, quotes, etc.) or is one of the reserved prototype keys. Example: 'items[0]' (bracket notation), 'a b' (space), or 'foo.__proto__'.

Common situations: Using JSONPath/bracket notation instead of dotted notation; copying a path with special characters; an attacker- or user-supplied key that attempts prototype pollution.

Related errors

• ${field} must be a dot-separated JSON path
• outputMapping.dataPaths.from array segment is invalid: ${seg
• outputMapping.dataPaths.to array segments must be non-negati
• project_files.read_json does not follow symlinks
• project_files.read_json path escapes project dir

AI-assisted analysis of nexu-io/open-design@5be4028344 (2026-08-12). Data as JSON: /api/errors/794c3eb57eb759fb. Report an issue: GitHub.