Summary

• Fixed panic in generated query parameter parsing code when malformed brackets are provided
• Added validation to check that brackets are properly paired and ordered before attempting string slicing
• Updated test expectations to match the new error handling

Problem

When query parameters with malformed brackets are sent (e.g., custom_field[id]]][operator] or custom_field[[nestedbrackets]]), the generated code would panic with runtime error: slice bounds out of range [2:0].

This occurred because the code only checked if the closing bracket was missing (closeIdx == -1) but didn't validate:

1. If the opening bracket exists (openIdx == -1)
2. If the closing bracket comes after the opening bracket (closeIdx <= openIdx)

Solution

Updated the template to check all three conditions:

if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
    err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
}