fix(plugins): handle nil intermediate values in JSON path traversal

Replace jsonpointer library calls with defensive manual traversal to prevent
panic on nil intermediate values during field mutation. Adds recursive
setValueAtPath function with proper array and map handling.

Fixes: panic: reflect: call of reflect.Value.Type on zero Value

Signed-off-by: Matthew F Leader <mleader@redhat.com>

Author: mfleader

pkg/deploy/plugins/field_mutator.go

@@ -1,8 +1,8 @@
 package plugins
 
 import (
+	"encoding/json"
 	"fmt"
-	"strings"
 
 	"github.com/go-openapi/jsonpointer"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -126,53 +126,135 @@ func setTargetField(res *resource.Resource, value any, mapping FieldMapping) err
 }
 
 func setWithPathCreation(data any, ptr jsonpointer.Pointer, value any) (any, error) {
-	// try setting value if the path already exists
-	if updatedData, err := ptr.Set(data, value); err == nil {
-		return updatedData, nil
+	// use manual path traversal to avoid jsonpointer panics on nil intermediate values
+	tokens := ptr.DecodedTokens()
+	if len(tokens) == 0 {
+		return value, nil
 	}
 
-	// otherwise, we need to create the path first
-	tokens := ptr.DecodedTokens()
+	// start with a copy of the original data to avoid mutations on errors
+	result := deepCopyData(data)
+
+	// build path step by step using recursive helper
+	return setValueAtPath(result, tokens, value)
+}
+
+// setValueAtPath recursively sets a value at the given path, creating intermediate structures as needed
+func setValueAtPath(data any, tokens []string, value any) (any, error) {
 	if len(tokens) == 0 {
 		return value, nil
 	}
-	result := data
 
-	// JSON Pointer Set() fails if intermediate paths don't exist, so we must
-	// build the path incrementally from root to target, creating missing containers
-	for i := 1; i <= len(tokens)-1; i++ {
-		partialPath := "/" + strings.Join(tokens[:i], "/")
-		partialPtr, err := jsonpointer.New(partialPath)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create partial pointer: %w", err)
+	if len(tokens) == 1 {
+		// final token - set the value
+		token := tokens[0]
+		if isNumericString(token) {
+			// array index
+			arr, ok := data.([]any)
+			if !ok {
+				return nil, fmt.Errorf("expected array for numeric index %q", token)
+			}
+			index := parseNumericToken(token)
+			// extend array if necessary
+			for len(arr) <= index {
+				arr = append(arr, nil)
+			}
+			arr[index] = value
+			return arr, nil
+		} else {
+			// map key
+			m, ok := data.(map[string]any)
+			if !ok {
+				return nil, fmt.Errorf("expected map for key %q", token)
+			}
+			m[token] = value
+			return m, nil
 		}
-		// Get() is used as existence test - error means path doesn't exist and needs creation
-		_, _, err = partialPtr.Get(result)
-		if err != nil {
-			nextToken := tokens[i]
-			var newContainer any
-			// create array if next token is numeric (e.g., "/ports/0")
-			if isNumericString(nextToken) {
-				newContainer = make([]any, 0)
+	}
+
+	// intermediate token - traverse or create structure
+	token := tokens[0]
+	if isNumericString(token) {
+		// array index
+		arr, ok := data.([]any)
+		if !ok {
+			return nil, fmt.Errorf("expected array for numeric index %q", token)
+		}
+		index := parseNumericToken(token)
+		// extend array if necessary
+		for len(arr) <= index {
+			arr = append(arr, nil)
+		}
+
+		// get or create next container
+		next := arr[index]
+		if next == nil {
+			// create based on next token
+			if isNumericString(tokens[1]) {
+				next = make([]any, 0)
 			} else {
-				// create map otherwise (e.g., "/spec/strategy")
-				newContainer = make(map[string]any)
+				next = make(map[string]any)
 			}
+		}
 
-			// create the missing path segment
-			result, err = partialPtr.Set(result, newContainer)
-			if err != nil {
-				return nil, fmt.Errorf("failed to create intermediate path %q: %w", partialPath, err)
+		// recursively set the rest of the path
+		updated, err := setValueAtPath(next, tokens[1:], value)
+		if err != nil {
+			return nil, err
+		}
+		arr[index] = updated
+		return arr, nil
+	} else {
+		// map key
+		m, ok := data.(map[string]any)
+		if !ok {
+			return nil, fmt.Errorf("expected map for key %q", token)
+		}
+
+		// get or create next container
+		next, exists := m[token]
+		if !exists || next == nil {
+			// create based on next token
+			if isNumericString(tokens[1]) {
+				next = make([]any, 0)
+			} else {
+				next = make(map[string]any)
 			}
 		}
+
+		// recursively set the rest of the path
+		updated, err := setValueAtPath(next, tokens[1:], value)
+		if err != nil {
+			return nil, err
+		}
+		m[token] = updated
+		return m, nil
+	}
+}
+
+// parseNumericToken converts a numeric string to int, assuming it's already validated
+func parseNumericToken(s string) int {
+	result := 0
+	for _, r := range s {
+		result = result*10 + int(r-'0')
 	}
+	return result
+}
 
-	result, err := ptr.Set(result, value)
+// deepCopyData creates a deep copy of the data structure using JSON marshal/unmarshal
+func deepCopyData(data any) any {
+	// Use JSON marshal/unmarshal for deep copy - simple and reliable
+	jsonBytes, err := json.Marshal(data)
 	if err != nil {
-		return nil, fmt.Errorf("failed to set final value: %w", err)
+		return data // fallback to original if copy fails
+	}
+
+	var result any
+	if err := json.Unmarshal(jsonBytes, &result); err != nil {
+		return data // fallback to original if copy fails
 	}
 
-	return result, nil
+	return result
 }
 
 func updateResource(res *resource.Resource, updatedData any) error {

pkg/deploy/plugins/field_mutator_test.go

@@ -293,3 +293,57 @@ func TestTransform(t *testing.T) {
 		})
 	}
 }
+
+// TestJsonPointerNilTraversalPanic reproduces the panic when jsonpointer encounters nil intermediate values
+func TestJsonPointerNilTraversalPanic(t *testing.T) {
+	t.Run("panic when traversing through nil intermediate value", func(t *testing.T) {
+		// create a data structure with nil intermediate value that causes jsonpointer to panic
+		testData := map[string]any{
+			"apiVersion": "v1",
+			"kind":       "TestResource",
+			"metadata": map[string]any{
+				"name": "test-resource",
+			},
+			"spec": map[string]any{
+				"container": map[string]any{
+					"properties": nil, // this nil causes the panic when traversed
+				},
+			},
+		}
+
+		rf := resource.NewFactory(nil)
+		res, err := rf.FromMap(testData)
+		require.NoError(t, err)
+
+		resMap := resmap.New()
+		require.NoError(t, resMap.Append(res))
+
+		// field mapping that attempts to traverse through the nil intermediate value
+		transformer := CreateFieldMutator(FieldMutatorConfig{
+			Mappings: []FieldMapping{
+				{
+					SourceValue:       nil,
+					DefaultValue:      "test-value",
+					TargetField:       "/spec/container/properties/name", // this path goes through nil
+					TargetKind:        "TestResource",
+					CreateIfNotExists: true,
+				},
+			},
+		})
+
+		err = transformer.Transform(resMap)
+		require.NoError(t, err, "Transform should succeed after the fix")
+
+		// nil properties should be replaced with a proper map
+		updatedRes := resMap.GetByIndex(0)
+		resMap2, err := updatedRes.Map()
+		require.NoError(t, err)
+
+		spec := resMap2["spec"].(map[string]any)
+		container := spec["container"].(map[string]any)
+		properties := container["properties"].(map[string]any)
+
+		require.Equal(t, "test-value", properties["name"], "name should be set correctly")
+		require.NotNil(t, properties, "properties should no longer be nil")
+	})
+}