fix: allow bare @ in any position (e.g., $[?(@)], $[?(!@)],

    `$[?(@?1:0)]`) and avoid rewriting `@` inside quoted string literals

Author: brettz9

CHANGES.md

@@ -1,5 +1,11 @@
 # CHANGES for jsonpath-plus
 
+## 11.0.2
+
+- fix: allow bare `@` in any position (e.g., `$[?(@>1)]`, `$[?(@)]`,
+    `$[?(!@)]`) and stop rewriting `@` inside quoted string literals
+    (@spokodev)
+
 ## 11.0.1
 
 - fix(security) nested filter bypass exploit (@andrewmacheret)

badges/tests-badge.svg

@@ -2369,7 +2369,10 @@ class JSONPathClass {
     }
     const scriptCacheKey = this.currEval + 'Script:' + code;
     if (!scriptCache.has(scriptCacheKey)) {
-      let script = code.replaceAll('@parentProperty', '_$_parentProperty').replaceAll('@parent', '_$_parent').replaceAll('@property', '_$_property').replaceAll('@root', '_$_root').replaceAll(/@([.\s\)\[])/gv, '_$_v$1');
+      let script = code.replaceAll('@parentProperty', '_$_parentProperty').replaceAll('@parent', '_$_parent').replaceAll('@property', '_$_property').replaceAll('@root', '_$_root')
+      // Replace a bare `@` (not followed by an identifier
+      //   character) while leaving quoted string literals intact
+      .replaceAll(/('(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*")|@(?![\w$])/gv, (_, str) => str ?? '_$_v');
       if (containsPath) {
         script = script.replaceAll('@path', '_$_path');
       }

dist/index-browser-esm.js

@@ -2375,7 +2375,10 @@
 	    }
 	    const scriptCacheKey = this.currEval + 'Script:' + code;
 	    if (!scriptCache.has(scriptCacheKey)) {
-	      let script = code.replaceAll('@parentProperty', '_$_parentProperty').replaceAll('@parent', '_$_parent').replaceAll('@property', '_$_property').replaceAll('@root', '_$_root').replaceAll(/@([.\s\)\[])/gv, '_$_v$1');
+	      let script = code.replaceAll('@parentProperty', '_$_parentProperty').replaceAll('@parent', '_$_parent').replaceAll('@property', '_$_property').replaceAll('@root', '_$_root')
+	      // Replace a bare `@` (not followed by an identifier
+	      //   character) while leaving quoted string literals intact
+	      .replaceAll(/('(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*")|@(?![\w$])/gv, (_, str) => str ?? '_$_v');
 	      if (containsPath) {
 	        script = script.replaceAll('@path', '_$_path');
 	      }

dist/index-browser-esm.min.js

@@ -2373,7 +2373,10 @@ class JSONPathClass {
     }
     const scriptCacheKey = this.currEval + 'Script:' + code;
     if (!scriptCache.has(scriptCacheKey)) {
-      let script = code.replaceAll('@parentProperty', '_$_parentProperty').replaceAll('@parent', '_$_parent').replaceAll('@property', '_$_property').replaceAll('@root', '_$_root').replaceAll(/@([.\s\)\[])/gv, '_$_v$1');
+      let script = code.replaceAll('@parentProperty', '_$_parentProperty').replaceAll('@parent', '_$_parent').replaceAll('@property', '_$_property').replaceAll('@root', '_$_root')
+      // Replace a bare `@` (not followed by an identifier
+      //   character) while leaving quoted string literals intact
+      .replaceAll(/('(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*")|@(?![\w$])/gv, (_, str) => str ?? '_$_v');
       if (containsPath) {
         script = script.replaceAll('@path', '_$_path');
       }

dist/index-browser-esm.min.js.map

@@ -2371,7 +2371,10 @@ class JSONPathClass {
     }
     const scriptCacheKey = this.currEval + 'Script:' + code;
     if (!scriptCache.has(scriptCacheKey)) {
-      let script = code.replaceAll('@parentProperty', '_$_parentProperty').replaceAll('@parent', '_$_parent').replaceAll('@property', '_$_property').replaceAll('@root', '_$_root').replaceAll(/@([.\s\)\[])/gv, '_$_v$1');
+      let script = code.replaceAll('@parentProperty', '_$_parentProperty').replaceAll('@parent', '_$_parent').replaceAll('@property', '_$_property').replaceAll('@root', '_$_root')
+      // Replace a bare `@` (not followed by an identifier
+      //   character) while leaving quoted string literals intact
+      .replaceAll(/('(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*")|@(?![\w$])/gv, (_, str) => str ?? '_$_v');
       if (containsPath) {
         script = script.replaceAll('@path', '_$_path');
       }