In REST Assured, how do you put a runtime value into a JsonPath GPath expression safely?

## The path is code, not a query string REST Assured's JSON path expressions are Groovy. The evaluator concatenates your path onto an internal root variable, compiles the result as a one-line Groovy script, and runs it with the parsed document bound in. That is what makes closures such as `findAll { it.confidence < 0.5 }` work at all — they are real Groovy closures, compiled and executed at assertion time. The consequence follows immediately: anything you splice into the path text becomes part of the program. Consider a helper on a translation-glossary suite that takes a locale from a fixture file, an environment variable or a CSV row: ```java // Do not do this List<String> terms = jsonPath.getList( "glossary.entry.findAll { it.targetLocale == '" + locale + "' }.term"); ``` If `locale` ever carries a quote, a brace or a method call, the compiled script is no longer the one you wrote. This is the ordinary injection shape — untrusted data crossing into an interpreter — and the library's own Javadoc calls it out. ## The failure modes, in the order you will meet them 1. **A quote in the data.** A French glossary term such as `l'article` closes the Groovy string literal early. Compilation fails and REST Assured reports `IllegalArgumentException` beginning *Invalid JSON expression:*. Harmless, noisy, and the first sign that the helper is built wrong. 2. **A brace or operator in the data.** The path still compiles, but it no longer means what you wrote. The assertion passes or fails for reasons unrelated to the response. 3. **Executable content in the data.** Because the fragment is compiled as Groovy, a value can invoke methods. Whether that is exploitable depends on where the value came from, but the mechanism is real and it is not defended by escaping quotes. ## The supported mechanism: JsonPath.param `JsonPath.param(String key, Object value)` adds the value to the map that becomes the script's Groovy binding. Inside the expression the value is then a plain identifier — no quoting, no escaping, no concatenation: ```java List<String> terms = jsonPath .param("targetLocale", requestedLocale) .getList("glossary.entry.findAll { it.targetLocale == targetLocale }.term"); ``` Points that catch people out: - `param` returns a **new `JsonPath` instance** rather than mutating the receiver. Calling it on its own line and then querying the original silently loses the binding, and you get the "not defined" error below. - Referencing an identifier you never bound throws `IllegalArgumentException` with the message *The parameter "x" was used but not defined. Define parameters using the JsonPath.param(...) function*. That message is the single clearest signal that a `param` call was dropped or not chained. - Bind as many parameters as you need by chaining `param` calls; each returns a further instance. - The value keeps its Java type in the binding, so a number compares as a number and a string as a string — which is also why you no longer have to think about quoting. - There is **no `param` hook on the validation side**. `then().body(path, matcher)` accepts a path and a matcher, nothing else, so a path that must carry a runtime value belongs on a `JsonPath` you hold — either standalone via `JsonPath.from(body)` or from the response object. | Approach | What the evaluator compiles | Verdict | |---|---|---| | `"... == '" + locale + "' }"` | your data, as Groovy source | injection; also breaks on an apostrophe | | `String.format` into the path | same as above, with nicer syntax | no safer; formatting is not escaping | | `.param("locale", locale)` | a fixed script plus a bound variable | correct | ## What 6.0.0 changed here — and what it did not The `json-path` module was migrated fully to Java in 6.0.0, and the evaluator stopped using a `GroovyShell`: it now compiles with `GroovyClassLoader.parseClass(...)` and runs the result through `InvokerHelper.createScript(...)`, which fixed memory leaks in long-running processes that leaned on `JsonPath`. It is tempting to read that as "Groovy is gone from JSON paths". It is not. The expression is still Groovy, still compiled, still executed — only the host class changed. The injection hazard is exactly as it was, and the `JsonPath` class Javadoc still describes a Groovy shell, which is now stale text rather than a description of the code. ## How to hold the line in a suite - Make concatenation into a path a review-blocking pattern, the same way string-built SQL is. - Keep paths as constants and vary only the bound parameters, so a grep for `" + ` inside a path string finds every offender. - Where the value is a fixed set — a locale from a known list, a status from an enum — validating it against that list is a good extra layer, but it is a second line of defence, not the fix. - Remember the general principle is not REST Assured's: data crossing into an interpreter must be bound, not escaped. `param` is simply this library's binding API.