core: harden setDataAt/unsetDataAt against edge cases

Improvements on top of the lodash/fp/set replacement:

- Store "__proto__" segments as own properties via defineProperty and
  traverse own properties only, so such keys neither corrupt the
  container's prototype nor get dropped. Clone containers key-by-key
  because downleveled object spreads assign instead of define.
- Read the updater's old data with resolveData instead of lodash get,
  so reads use the same literal path semantics as writes.
- Fall back to lodash's index heuristic when creating missing
  containers without schema type information.
- Match lodash's isIndex semantics with a strict index regex instead
  of Number() coercion.
- Avoid strict-mode TypeErrors when unsetting non-index array
  properties (e.g. "length") and return the same reference when
  there is nothing to unset.
- Treat an empty path as addressing the root, and replace non-object
  root data instead of spreading it.

Also documents the path semantics change in MIGRATION.md and adds unit
tests for setDataAt/unsetDataAt.

Author: sdirix

MIGRATION.md

@@ -40,6 +40,16 @@ return this.t(label, label) as string;
 
 This does not affect the Composition API where `Translator` is accessed directly from a `ComputedRef`.
 
+### Data update paths treat all segments literally
+
+Data updates (e.g. dispatched `update` actions) previously wrote to the form data via lodash's `set`/`unset`, which interpret bracket notation and array indices in paths.
+This corrupted data for property names that look like lodash path syntax, for example numeric property names like `"15"` were turned into array indices and names containing brackets like `"prop[0]"` were split up (see [#2397](https://github.com/eclipsesource/jsonforms/issues/2397) and [#2102](https://github.com/eclipsesource/jsonforms/issues/2102)).
+
+Updates now use the new `setDataAt`/`unsetDataAt` utilities of `@jsonforms/core`, which split paths on `.` and treat every segment as a literal property name, matching how JSON Forms resolves values for display.
+When a missing intermediate container is created, the JSON Schema decides whether it becomes an array or an object; without schema type information, a numeric follow-up segment creates an array, as before.
+
+If you dispatch update actions yourself, make sure to use dot-separated paths (e.g. `update('list.0.name', ...)`) instead of lodash bracket syntax (e.g. `update('list[0].name', ...)`), which is no longer interpreted.
+
 ### Angular support now targets Angular 20 to 22
 
 When using JSON Forms 3.8, your Angular application now needs to target Angular 20, 21 or 22.

packages/core/src/reducers/core.ts

@@ -24,8 +24,8 @@
 */
 
 import cloneDeep from 'lodash/cloneDeep';
-import get from 'lodash/get';
 import isEqual from 'lodash/isEqual';
+import { resolveData } from '../util/resolvers';
 import { setDataAt, unsetDataAt } from '../util/setData';
 import {
   CoreActions,
@@ -237,7 +237,7 @@ export const coreReducer: Reducer<JsonFormsCore, CoreActions> = (
           errors,
         };
       } else {
-        const oldData: any = get(state.data, action.path);
+        const oldData: any = resolveData(state.data, action.path);
         const newData = action.updater(cloneDeep(oldData));
         let newState: any;
         if (newData !== undefined) {

packages/core/src/util/setData.ts

@@ -26,10 +26,17 @@
 import type { JsonSchema } from '../models';
 import { encode } from './path';
 import { resolveSchema } from './resolvers';
-import { hasType } from './util';
+import { deriveTypes, hasType } from './util';
 
 const splitPath = (path: string): string[] => path.split('.');
 
+/**
+ * Whether the segment addresses an array element, i.e. is a canonical
+ * non-negative integer without leading zeros.
+ */
+const isIndexSegment = (segment: string): boolean =>
+  /^(?:0|[1-9]\d*)$/.test(segment);
+
 /**
  * Walks one step in the schema along the given data path segment, so we can
  * tell whether a missing intermediate container should be created as an
@@ -51,21 +58,64 @@ const stepSchema = (
   return resolveSchema(schema, pointer, rootSchema);
 };
 
+const assign = (container: any, segment: string, value: any): any => {
+  if (segment === '__proto__') {
+    // A plain assignment would overwrite the container's prototype instead
+    // of creating an own property.
+    Object.defineProperty(container, segment, {
+      value,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    });
+  } else {
+    container[segment] = value;
+  }
+  return container;
+};
+
 const cloneContainer = (data: any): any => {
   if (Array.isArray(data)) {
     return [...data];
   }
-  return { ...(data ?? {}) };
+  if (typeof data === 'object' && data !== null) {
+    // Not a spread because downleveled object spreads assign instead of
+    // defining properties, which mishandles own "__proto__" properties.
+    const clone: { [key: string]: any } = {};
+    for (const key of Object.keys(data)) {
+      assign(clone, key, data[key]);
+    }
+    return clone;
+  }
+  return {};
 };
 
-const assign = (container: any, segment: string, value: any): any => {
-  if (Array.isArray(container)) {
-    const index = Number(segment);
-    container[Number.isInteger(index) ? index : (segment as any)] = value;
-  } else {
-    container[segment] = value;
+/**
+ * Looks up the own property `segment` of `data`, ignoring inherited
+ * properties like `__proto__`, mirroring the semantics of `resolveData`.
+ */
+const ownPropertyValue = (data: any, segment: string): any =>
+  data != null && Object.prototype.hasOwnProperty.call(data, segment)
+    ? data[segment]
+    : undefined;
+
+/**
+ * Determines the container to create for a missing child. The schema takes
+ * precedence; without any schema type information the next path segment
+ * decides, mirroring the behavior of lodash's `set`.
+ */
+const createInitialContainer = (
+  childSchema: JsonSchema | undefined,
+  nextSegment: string
+): any => {
+  const types = childSchema ? deriveTypes(childSchema) : [];
+  if (types.includes('array')) {
+    return [];
   }
-  return container;
+  if (types.length > 0) {
+    return {};
+  }
+  return isIndexSegment(nextSegment) ? [] : {};
 };
 
 /**
@@ -74,19 +124,21 @@ const assign = (container: any, segment: string, value: any): any => {
  * Numeric path segments and segments containing bracket notation are treated
  * as plain object property names. The optional `rootSchema` is consulted when
  * a new intermediate container has to be created, so that arrays are still
- * created where the schema declares an array type.
+ * created where the schema declares an array type. Without schema type
+ * information, a canonical numeric follow-up segment creates an array.
+ *
+ * An empty `path` addresses the root, i.e. `value` itself is returned.
  */
 export const setDataAt = (
   data: any,
   path: string,
   value: any,
   rootSchema?: JsonSchema
 ): any => {
-  const segments = splitPath(path);
-  if (segments.length === 0) {
+  if (path === '') {
     return value;
   }
-  return doSet(data, segments, 0, value, rootSchema, rootSchema);
+  return doSet(data, splitPath(path), 0, value, rootSchema, rootSchema);
 };
 
 const doSet = (
@@ -98,39 +150,26 @@ const doSet = (
   rootSchema: JsonSchema | undefined
 ): any => {
   const segment = segments[index];
-  const childSchema = stepSchema(currentSchema, segment, rootSchema);
   const container = cloneContainer(data);
 
   if (index === segments.length - 1) {
     return assign(container, segment, value);
   }
 
-  const existingChild = data?.[segment];
-  let nextValue;
-  if (
-    existingChild !== undefined &&
-    existingChild !== null &&
-    typeof existingChild === 'object'
-  ) {
-    nextValue = doSet(
-      existingChild,
-      segments,
-      index + 1,
-      value,
-      childSchema,
-      rootSchema
-    );
-  } else {
-    const initial = hasType(childSchema, 'array') ? [] : {};
-    nextValue = doSet(
-      initial,
-      segments,
-      index + 1,
-      value,
-      childSchema,
-      rootSchema
-    );
-  }
+  const childSchema = stepSchema(currentSchema, segment, rootSchema);
+  const existingChild = ownPropertyValue(data, segment);
+  const child =
+    existingChild !== null && typeof existingChild === 'object'
+      ? existingChild
+      : createInitialContainer(childSchema, segments[index + 1]);
+  const nextValue = doSet(
+    child,
+    segments,
+    index + 1,
+    value,
+    childSchema,
+    rootSchema
+  );
   return assign(container, segment, nextValue);
 };
 
@@ -139,49 +178,47 @@ const doSet = (
  *
  * Numeric path segments and bracket notation in segments are treated as
  * plain object property names, mirroring the semantics of {@link setDataAt}.
+ * Unsetting an array element leaves a hole, i.e. the array is not compacted.
+ * If there is nothing to unset at `path`, `data` is returned unchanged.
  */
 export const unsetDataAt = (data: any, path: string): any => {
-  const segments = splitPath(path);
-  if (segments.length === 0) {
+  if (path === '') {
     return data;
   }
-  return doUnset(data, segments, 0);
+  return doUnset(data, splitPath(path), 0);
 };
 
 const doUnset = (data: any, segments: string[], index: number): any => {
-  if (data === undefined || data === null) {
+  if (data === null || typeof data !== 'object') {
     return data;
   }
   const segment = segments[index];
   if (index === segments.length - 1) {
+    if (!Object.prototype.hasOwnProperty.call(data, segment)) {
+      return data;
+    }
     if (Array.isArray(data)) {
-      const container = [...data];
-      const numericIndex = Number(segment);
-      if (Number.isInteger(numericIndex)) {
-        delete container[numericIndex];
+      // Non-index own properties of arrays (e.g. `length`) are not form data
+      // and deleting them could throw in strict mode.
+      if (!isIndexSegment(segment)) {
+        return data;
       }
+      const container = [...data];
+      delete container[Number(segment)];
       return container;
     }
-    if (!Object.prototype.hasOwnProperty.call(data, segment)) {
-      return data;
-    }
-    const container: { [key: string]: any } = { ...data };
+    const container = cloneContainer(data);
     delete container[segment];
     return container;
   }
 
-  const existingChild = data[segment];
-  if (
-    existingChild === undefined ||
-    existingChild === null ||
-    typeof existingChild !== 'object'
-  ) {
+  const existingChild = ownPropertyValue(data, segment);
+  if (existingChild === null || typeof existingChild !== 'object') {
     return data;
   }
   const nextValue = doUnset(existingChild, segments, index + 1);
   if (nextValue === existingChild) {
     return data;
   }
-  const container = cloneContainer(data);
-  return assign(container, segment, nextValue);
+  return assign(cloneContainer(data), segment, nextValue);
 };

packages/core/test/reducers/core.test.ts

@@ -860,6 +860,41 @@ test('core reducer - update - unset works for numeric and bracket-containing key
   });
 });
 
+test('core reducer - update - updater receives the current value for special property names', (t) => {
+  const schema: JsonSchema = {
+    type: 'object',
+    properties: {
+      'test[0]': { type: 'string' },
+      'group-key': {
+        type: 'object',
+        properties: {
+          '15': { type: 'string' },
+        },
+      },
+    },
+  };
+
+  const before: JsonFormsCore = {
+    data: { 'test[0]': 'a', 'group-key': { '15': 'x' } },
+    schema,
+    uischema: { type: 'Label' },
+    errors: [],
+    validator: new Ajv().compile(schema),
+  };
+
+  const afterBracket = coreReducer(
+    before,
+    update('test[0]', (old) => old + '!')
+  );
+  t.is((afterBracket.data as any)['test[0]'], 'a!');
+
+  const afterNumeric = coreReducer(
+    afterBracket,
+    update('group-key.15', (old) => old + '!')
+  );
+  t.is((afterNumeric.data as any)['group-key']['15'], 'x!');
+});
+
 test('core reducer - updateErrors - should update errors with empty list', (t) => {
   const before: JsonFormsCore = {
     data: {},