QTypedJson::Reader: don't parse JS objects as JS arraysHEADdev

Add a missing check in Reader::startArray() and error out when currently
not processing a JS array.

The Reader::handleVariant() algorithm relies on this warning to find the
correct variant type represented by the JSON.

Task-number: QTBUG-141713
Change-Id: I0be5de9827683d2e0e6e0301bdb147e0bb70cf15
Reviewed-by: Olivier De Cannière <olivier.decanniere@qt.io>

2 files changed, 19 insertions, 0 deletions

diff --git a/src/jsonrpc/qtypedjson_p.h b/src/jsonrpc/qtypedjson_p.h
index 859ca6a..c9aa1a5 100644
--- a/src/jsonrpc/qtypedjson_p.h
+++ b/src/jsonrpc/qtypedjson_p.h
@@ -261,6 +261,10 @@ public:
     template<typename T>
     bool startArray(qint32 &size, T &el)
     {
+        if (!currentValue().isArray()) {
+            warn(QStringLiteral(u"Error: expected an array at %1.").arg(currentPath()));
+            return false;
+        }
         startArrayF(size);
         using BaseT = std::decay_t<T>;
         if constexpr (std::is_base_of_v<QList<typename BaseT::value_type>, BaseT>) {
diff --git a/tests/auto/typedjson/tst_typedjson.h b/tests/auto/typedjson/tst_typedjson.h
index 0f7babb..4cf19df 100644
--- a/tests/auto/typedjson/tst_typedjson.h
+++ b/tests/auto/typedjson/tst_typedjson.h
@@ -353,6 +353,21 @@ private slots:
         runTest(b);
         runTest(c);
     }
+
+    void testBadArray()
+    {
+        const QMap<QByteArray, int> unexpected{
+            { "a", 1 },
+            { "b", 2 },
+            { "c", 3 },
+        };
+        const QJsonValue unexpectedJson = toJsonValue(unexpected);
+
+        QTypedJson::Reader r(unexpectedJson);
+        QList<int> result;
+        QTypedJson::doWalk(r, result);
+        QCOMPARE(r.errorMessages(), { "Error: expected an array at ."_L1 });
+    }
 };
 
 } // namespace QTypedJson