fix(plugins): handle nil intermediate values in JSON path traversal

Replace jsonpointer library calls with defensive manual traversal to prevent
panic on nil intermediate values during field mutation. Adds recursive
setValueAtPath function with proper array and map handling.

Fixes: panic: reflect: call of reflect.Value.Type on zero Value

Signed-off-by: Matthew F Leader <mleader@redhat.com>

Author: mfleader

pkg/deploy/plugins/field_mutator.go

@@ -1,8 +1,8 @@
 package plugins
 
 import (
+	"encoding/json"
 	"fmt"
-	"strings"
 
 	"github.com/go-openapi/jsonpointer"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -126,53 +126,154 @@ func setTargetField(res *resource.Resource, value any, mapping FieldMapping) err
 }
 
 func setWithPathCreation(data any, ptr jsonpointer.Pointer, value any) (any, error) {
-	// try setting value if the path already exists
-	if updatedData, err := ptr.Set(data, value); err == nil {
-		return updatedData, nil
+	// use manual path traversal to avoid jsonpointer panics on nil intermediate values
+	tokens := ptr.DecodedTokens()
+	if len(tokens) == 0 {
+		return value, nil
 	}
 
-	// otherwise, we need to create the path first
-	tokens := ptr.DecodedTokens()
+	// start with a copy of the original data to avoid mutations on errors
+	result := deepCopyData(data)
+
+	// build path step by step using recursive helper
+	return setValueAtPath(result, tokens, value)
+}
+
+// setValueAtPath recursively sets a value at the given path, creating intermediate structures as needed.
+func setValueAtPath(data any, tokens []string, value any) (any, error) {
 	if len(tokens) == 0 {
 		return value, nil
 	}
-	result := data
 
-	// JSON Pointer Set() fails if intermediate paths don't exist, so we must
-	// build the path incrementally from root to target, creating missing containers
-	for i := 1; i <= len(tokens)-1; i++ {
-		partialPath := "/" + strings.Join(tokens[:i], "/")
-		partialPtr, err := jsonpointer.New(partialPath)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create partial pointer: %w", err)
-		}
-		// Get() is used as existence test - error means path doesn't exist and needs creation
-		_, _, err = partialPtr.Get(result)
-		if err != nil {
-			nextToken := tokens[i]
-			var newContainer any
-			// create array if next token is numeric (e.g., "/ports/0")
-			if isNumericString(nextToken) {
-				newContainer = make([]any, 0)
-			} else {
-				// create map otherwise (e.g., "/spec/strategy")
-				newContainer = make(map[string]any)
-			}
+	if len(tokens) == 1 {
+		return setFinalValue(data, tokens[0], value)
+	}
 
-			// create the missing path segment
-			result, err = partialPtr.Set(result, newContainer)
-			if err != nil {
-				return nil, fmt.Errorf("failed to create intermediate path %q: %w", partialPath, err)
-			}
-		}
+	return setIntermediateValue(data, tokens, value)
+}
+
+// setFinalValue sets the final value in the path (last token).
+func setFinalValue(data any, token string, value any) (any, error) {
+	if isNumericString(token) {
+		return setArrayValue(data, token, value)
 	}
+	return setMapValue(data, token, value)
+}
 
-	result, err := ptr.Set(result, value)
+// setArrayValue sets a value at an array index.
+func setArrayValue(data any, token string, value any) (any, error) {
+	arr, ok := data.([]any)
+	if !ok {
+		return nil, fmt.Errorf("failed to access array index %q: expected array", token)
+	}
+	index := parseNumericToken(token)
+	// extend array if necessary
+	for len(arr) <= index {
+		arr = append(arr, nil)
+	}
+	arr[index] = value
+	return arr, nil
+}
+
+// setMapValue sets a value at a map key.
+func setMapValue(data any, token string, value any) (any, error) {
+	m, ok := data.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("failed to access map key %q: expected map", token)
+	}
+	m[token] = value
+	return m, nil
+}
+
+// setIntermediateValue handles intermediate tokens in the path.
+func setIntermediateValue(data any, tokens []string, value any) (any, error) {
+	token := tokens[0]
+	if isNumericString(token) {
+		return setIntermediateArrayValue(data, tokens, value)
+	}
+	return setIntermediateMapValue(data, tokens, value)
+}
+
+// setIntermediateArrayValue handles array traversal for intermediate tokens.
+func setIntermediateArrayValue(data any, tokens []string, value any) (any, error) {
+	arr, ok := data.([]any)
+	if !ok {
+		return nil, fmt.Errorf("failed to access array index %q: expected array", tokens[0])
+	}
+	index := parseNumericToken(tokens[0])
+	// extend array if necessary
+	for len(arr) <= index {
+		arr = append(arr, nil)
+	}
+
+	// get or create next container
+	next := arr[index]
+	if next == nil {
+		next = createContainer(tokens[1])
+	}
+
+	// recursively set the rest of the path
+	updated, err := setValueAtPath(next, tokens[1:], value)
 	if err != nil {
-		return nil, fmt.Errorf("failed to set final value: %w", err)
+		return nil, err
+	}
+	arr[index] = updated
+	return arr, nil
+}
+
+// setIntermediateMapValue handles map traversal for intermediate tokens.
+func setIntermediateMapValue(data any, tokens []string, value any) (any, error) {
+	m, ok := data.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("failed to access map key %q: expected map", tokens[0])
+	}
+
+	// get or create next container
+	next, exists := m[tokens[0]]
+	if !exists || next == nil {
+		next = createContainer(tokens[1])
+	}
+
+	// recursively set the rest of the path
+	updated, err := setValueAtPath(next, tokens[1:], value)
+	if err != nil {
+		return nil, err
+	}
+	m[tokens[0]] = updated
+	return m, nil
+}
+
+// createContainer creates an appropriate container based on the next token.
+func createContainer(nextToken string) any {
+	if isNumericString(nextToken) {
+		return make([]any, 0)
+	}
+	return make(map[string]any)
+}
+
+// parseNumericToken converts a numeric string to int, assuming it's already validated.
+func parseNumericToken(s string) int {
+	result := 0
+	for _, r := range s {
+		result = result*10 + int(r-'0')
+	}
+	return result
+}
+
+// deepCopyData creates a deep copy of the data structure using JSON marshal/unmarshal.
+func deepCopyData(data any) any {
+	// Use JSON marshal/unmarshal for deep copy - simple and reliable
+	jsonBytes, err := json.Marshal(data)
+	if err != nil {
+		return data // fallback to original if copy fails
+	}
+
+	var result any
+	if err := json.Unmarshal(jsonBytes, &result); err != nil {
+		return data // fallback to original if copy fails
 	}
 
-	return result, nil
+	return result
 }
 
 func updateResource(res *resource.Resource, updatedData any) error {

pkg/deploy/plugins/field_mutator_test.go

@@ -293,3 +293,60 @@ func TestTransform(t *testing.T) {
 		})
 	}
 }
+
+// TestJsonPointerNilTraversalPanic reproduces the panic when jsonpointer encounters nil intermediate values.
+func TestJsonPointerNilTraversalPanic(t *testing.T) {
+	t.Run("panic when traversing through nil intermediate value", func(t *testing.T) {
+		// create a data structure with nil intermediate value that causes jsonpointer to panic
+		testData := map[string]any{
+			"apiVersion": "v1",
+			"kind":       "TestResource",
+			"metadata": map[string]any{
+				"name": "test-resource",
+			},
+			"spec": map[string]any{
+				"container": map[string]any{
+					"properties": nil, // this nil causes the panic when traversed
+				},
+			},
+		}
+
+		rf := resource.NewFactory(nil)
+		res, err := rf.FromMap(testData)
+		require.NoError(t, err)
+
+		resMap := resmap.New()
+		require.NoError(t, resMap.Append(res))
+
+		// field mapping that attempts to traverse through the nil intermediate value
+		transformer := CreateFieldMutator(FieldMutatorConfig{
+			Mappings: []FieldMapping{
+				{
+					SourceValue:       nil,
+					DefaultValue:      "test-value",
+					TargetField:       "/spec/container/properties/name", // this path goes through nil
+					TargetKind:        "TestResource",
+					CreateIfNotExists: true,
+				},
+			},
+		})
+
+		err = transformer.Transform(resMap)
+		require.NoError(t, err, "Transform should succeed after the fix")
+
+		// nil properties should be replaced with a proper map
+		updatedRes := resMap.GetByIndex(0)
+		resMap2, err := updatedRes.Map()
+		require.NoError(t, err)
+
+		spec, ok := resMap2["spec"].(map[string]any)
+		require.True(t, ok, "spec should be a map")
+		container, ok := spec["container"].(map[string]any)
+		require.True(t, ok, "container should be a map")
+		properties, ok := container["properties"].(map[string]any)
+		require.True(t, ok, "properties should be a map")
+
+		require.Equal(t, "test-value", properties["name"], "name should be set correctly")
+		require.NotNil(t, properties, "properties should no longer be nil")
+	})
+}