From dd1e2341e3df35e9de38959328caa7628e81b6b1 Mon Sep 17 00:00:00 2001
From: luofucong <luofc@foxmail.com>
Date: Thu, 17 Sep 2026 19:59:50 +0800
Subject: [PATCH] fix: reject unterminated quoted JSONPath fields

Signed-off-by: luofucong <luofc@foxmail.com>
---
 src/jsonpath/parser.rs      | 2 +-
 tests/it/jsonpath_parser.rs | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/jsonpath/parser.rs b/src/jsonpath/parser.rs
index 23073ef..57d9420 100644
--- a/src/jsonpath/parser.rs
+++ b/src/jsonpath/parser.rs
@@ -153,7 +153,7 @@ pub(crate) fn string(input: &[u8]) -> IResult<&[u8], Cow<'_, str>> {
             }
         }
     }
-    if i > 1 {
+    if i > 1 && i < input.len() {
         if escapes == 0 {
             if let Ok(s) = std::str::from_utf8(&input[1..i]) {
                 return Ok((&input[i + 1..], Cow::Borrowed(s)));
diff --git a/tests/it/jsonpath_parser.rs b/tests/it/jsonpath_parser.rs
index 53eeeca..3368bfe 100644
--- a/tests/it/jsonpath_parser.rs
+++ b/tests/it/jsonpath_parser.rs
@@ -101,6 +101,15 @@ fn test_json_path_error() {
         r#"$['1', ,'3']"#,
         r#"$['aaa'}'bbb']"#,
         r#"@ > 10"#,
+        // Unterminated quoted fields, including escaped and UTF-8 content.
+        r#"$."a"#,
+        r#""a"#,
+        r#"$["a"#,
+        r#"$."a\""#,
+        r#"$."a\\"#,
+        r#"$."\u0061"#,
+        r#"$."中文"#,
+        r#"$.a ? (@ == "value"#,
     ];
 
     for case in cases {