From e3a09bcf4336abe7103eaafb2e6520bc51140149 Mon Sep 17 00:00:00 2001
From: magiccwarss <matem.mayreni@gmail.com>
Date: Sat, 7 Nov 2026 16:56:49 +0400
Subject: [PATCH] Restrict expression references to function argument positions

---
 jmespath/parser.py                   | 10 ++--
 tests/compliance/expref_context.json | 78 ++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+), 5 deletions(-)
 create mode 100644 tests/compliance/expref_context.json

diff --git a/jmespath/parser.py b/jmespath/parser.py
index cc8e804e..a9dc173b 100644
--- a/jmespath/parser.py
+++ b/jmespath/parser.py
@@ -250,10 +250,6 @@ def _parse_slice_expression(self):
     def _token_nud_current(self, token):
         return ast.current_node()
 
-    def _token_nud_expref(self, token):
-        expression = self._expression(self.BINDING_POWER['expref'])
-        return ast.expref(expression)
-
     def _token_led_dot(self, left):
         if not self._current_token() == 'star':
             right = self._parse_dot_rhs(self.BINDING_POWER['dot'])
@@ -293,7 +289,11 @@ def _token_led_lparen(self, left):
         name = left['value']
         args = []
         while not self._current_token() == 'rparen':
-            expression = self._expression()
+            if self._current_token() == 'expref':
+                self._advance()
+                expression = ast.expref(self._expression())
+            else:
+                expression = self._expression()
             if self._current_token() == 'comma':
                 self._match('comma')
             args.append(expression)
diff --git a/tests/compliance/expref_context.json b/tests/compliance/expref_context.json
new file mode 100644
index 00000000..8283e775
--- /dev/null
+++ b/tests/compliance/expref_context.json
@@ -0,0 +1,78 @@
+[
+  {
+    "given": {
+      "foo": true,
+      "items": [
+        {
+          "foo": 2
+        },
+        {
+          "foo": 1
+        }
+      ]
+    },
+    "cases": [
+      {
+        "expression": "&foo",
+        "error": "syntax"
+      },
+      {
+        "expression": "[&foo]",
+        "error": "syntax"
+      },
+      {
+        "expression": "{a: &foo}",
+        "error": "syntax"
+      },
+      {
+        "expression": "foo || &bar",
+        "error": "syntax"
+      },
+      {
+        "expression": "foo[?&bar]",
+        "error": "syntax"
+      },
+      {
+        "expression": "length([&foo])",
+        "error": "syntax"
+      },
+      {
+        "expression": "map((&foo), items)",
+        "error": "syntax"
+      },
+      {
+        "expression": "map(&&foo, items)",
+        "error": "syntax"
+      },
+      {
+        "expression": "map(&foo, items)",
+        "result": [
+          2,
+          1
+        ]
+      },
+      {
+        "expression": "sort_by(items, &foo)[].foo",
+        "result": [
+          1,
+          2
+        ]
+      },
+      {
+        "expression": "map(&(foo || `0`), items)",
+        "result": [
+          2,
+          1
+        ]
+      },
+      {
+        "expression": "map(&map(&foo, @), `[ [{\"foo\": 3}] ]`)",
+        "result": [
+          [
+            3
+          ]
+        ]
+      }
+    ]
+  }
+]