fix invalid remove index

2 files changed, 16 insertions, 0 deletions

diff --git a/jsonpatch.py b/jsonpatch.py
index 1bced46..238a6c9 100644
--- a/jsonpatch.py
+++ b/jsonpatch.py
@@ -39,6 +39,12 @@ import copy
 import functools
 import json
 import sys
+
+try:
+    from collections.abc import Mapping, Sequence
+except ImportError:  # Python 3
+    from collections import Mapping, Sequence
+
 try:
     from types import MappingProxyType
 except ImportError:
@@ -234,6 +240,10 @@ class RemoveOperation(PatchOperation):
 
     def apply(self, obj):
         subobj, part = self.pointer.to_last(obj)
+
+        if isinstance(subobj, Sequence) and not isinstance(part, int):
+            raise JsonPointerException("invalid array index '{0}'".format(part))
+
         try:
             del subobj[part]
         except (KeyError, IndexError) as ex:
diff --git a/tests.py b/tests.py
index 797c220..d9eea92 100755
--- a/tests.py
+++ b/tests.py
@@ -87,6 +87,12 @@ class ApplyPatchTestCase(unittest.TestCase):
         res = jsonpatch.apply_patch(obj, [{'op': 'remove', 'path': '/foo/1'}])
         self.assertEqual(res['foo'], ['bar', 'baz'])
 
+    def test_remove_invalid_item(self):
+        obj = {'foo': ['bar', 'qux', 'baz']}
+        with self.assertRaises(jsonpointer.JsonPointerException):
+            jsonpatch.apply_patch(obj, [{'op': 'remove', 'path': '/foo/-'}])
+
+
     def test_replace_object_key(self):
         obj = {'foo': 'bar', 'baz': 'qux'}
         res = jsonpatch.apply_patch(obj, [{'op': 'replace', 'path': '/baz', 'value': 'boo'}])