corvus_json_schema 0.1.3-x86_64-linux-gnu → 0.1.4-x86_64-linux-gnu

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16cb2daa10f3443d1841a771aa136b5154ff342edfd9676a69ce1644052a5c73
-  data.tar.gz: 861dfbdee3b6812ff9c9f85721d96e43903c5e0820825222ed600b5dedcefacf
+  metadata.gz: 3f9f6bb6707f84905d4183202f63d17820549fa0bc9e59146cb1c023b567c3f3
+  data.tar.gz: b4d903f3a3099e632d359b4ec176723bcd39818fda939acb9a54e08d37947d1d
 SHA512:
-  metadata.gz: ddfe91a5e2e58d1c2e769d784ac7fab9ad668234af1d435bcb5e05d58512d9399247cf9bfb0c8e31827a3dff64730a8c7ce9fd19cea0191de7d318d608e2487b
-  data.tar.gz: 966789046c025e59fb79b892ddcacf8b86dc88a9207ac24ae4d80f2f038f01d83aa9162c00707069dabdb3100bad684b4556a836142e212f39108cb19b35be64
+  metadata.gz: a0fd8866b27a7e1d948cdbef1102f7248859209fa69d4114a66dd0cff633a456cd3cc083a383ac29b5f593c99407c2ab0c8961ed71bb491b463cda35693a48c8
+  data.tar.gz: dad3d37892046b9afd0b906d798f41ee76a8b29577cf5392554f320ecfcfdb5ff438271efd770d564ff03b6c0ea006c346fa0161e58a3a26c0c331ea5736028d

data/README.md

@@ -53,6 +53,7 @@ Its options:
 | `base_uri` | `nil` | The schema's base URI, when it has no `$id`. |
 | `entry_point` | `nil` | A reference to the subschema to validate against, such as `"#/$defs/item"`. |
 | `max_depth` | `128` | The deepest the evaluator recurses in place before it raises `DepthError`. |
+| `pattern_match_limit` | `1.0` | The seconds one match of a `pattern` or `patternProperties` regular expression against one string may take before the validation raises `PatternMatchLimitError`. `nil` or `0` turns the limit off, for a caller who trusts both the schema and the instances. |
 
 A `Validator` is immutable and can be shared between threads.
 
@@ -65,7 +66,10 @@ A `Validator` is immutable and can be shared between threads.
   schema location.
 
 Errors are subclasses of `CorvusJsonSchema::Error`: `CompilationError` (an invalid schema, or a reference that cannot
-be resolved), `DepthError` and `InvalidJsonError` (for `valid_json?`). An error raised by a format or resolver callable
+be resolved), `PatternTooLargeError` (a `CompilationError` for a regular expression over a limit of size: 1,048,576
+bytes, 1,000 levels of groups, or about 16,000 terms), `DepthError`, `PatternMatchLimitError` (a match of a regular
+expression reached its limit, so the instance is neither valid nor not valid) and `InvalidJsonError` (for
+`valid_json?`). An error raised by a format or resolver callable
 propagates.
 
 ## Values
@@ -109,3 +113,8 @@ repository's submodule (or `JSON_SCHEMA_TEST_SUITE`).
 ## License
 
 Apache-2.0
+
+The gem is built on the `corvus-json-schema` Rust crate, whose Unicode tables are derived from the Unicode Character
+Database, which is under the Unicode License V3. [THIRD-PARTY-NOTICES.txt](THIRD-PARTY-NOTICES.txt) has that notice,
+and the one of the `regress` crate that the tables were first read from. The file is in the source gem and in every
+native gem, beside `LICENSE`.

data/THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,95 @@
+corvus_json_schema uses third-party libraries or other resources that may be
+distributed under licenses different than the corvus_json_schema software.
+
+In the event that we accidentally failed to list a required notice, please
+bring it to our attention. Post an issue or email us:
+
+           licensing@endjin.com
+
+The attached notices are provided for information only.
+
+License notice for the Unicode Character Database
+-------------------------------
+
+The gem is built on the corvus-json-schema Rust crate. The source gem holds
+the crate's sources (ext/corvus_json_schema/vendor/corvus-json-schema), and a
+native gem holds the extension compiled from them. src/ecmaregex/tables_gen.rs
+of that crate holds tables derived from the data files of the Unicode
+Character Database, version 17.0.0
+(https://www.unicode.org/Public/17.0.0/ucd/): the General_Category values, the
+binary properties, the Script and Script_Extensions values, the simple case
+folding and the simple uppercase mapping. The data files are "© 2025 Unicode®,
+Inc." and are licensed under the Unicode License V3 (SPDX-License-Identifier:
+Unicode-3.0), as https://www.unicode.org/license.txt gives it:
+
+UNICODE LICENSE V3
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright © 1991-2026 Unicode, Inc.
+
+NOTICE TO USER: Carefully read the following legal agreement. BY
+DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR
+SOFTWARE, YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
+TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT
+DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of data files and any associated documentation (the "Data Files") or
+software and any associated documentation (the "Software") to deal in the
+Data Files or Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, and/or sell
+copies of the Data Files or Software, and to permit persons to whom the
+Data Files or Software are furnished to do so, provided that either (a)
+this copyright and permission notice appear with all copies of the Data
+Files or Software, or (b) this copyright and permission notice appear in
+associated Documentation.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
+KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+THIRD PARTY RIGHTS.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE
+BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES,
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA
+FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall
+not be used in advertising or otherwise to promote the sale, use or other
+dealings in these Data Files or Software without prior written
+authorization of the copyright holder.
+
+License notice for https://github.com/ridiculousfish/regress
+-------------------------------
+
+The tables of src/ecmaregex/tables_gen.rs of the corvus-json-schema crate were
+written from the tables of the Corvus Go module, which were written from
+src/unicodetables.rs of regress 0.12.0. That crate generates the file from the
+Unicode Character Database. regress is licensed under the MIT license or the
+Apache License, Version 2.0, at the user's option. Neither the gem nor the
+corvus-json-schema crate depends on it.
+
+MIT License
+
+Copyright (c) 2020 ridiculous_fish
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/VERSIONHISTORY.md

@@ -2,6 +2,30 @@
 
 The version history of the `corvus_json_schema` Ruby gem. It is versioned independently of the Corvus NuGet packages and of the [corvus-json-schema](../../src-rs/corvus-json-schema/VERSIONHISTORY.md) Rust crate it is built on.
 
+## V0.1.4
+
+V0.1.4 takes version 0.1.7 of the `corvus-json-schema` crate. That fixes wrong results for several forms of pattern and a validation that did not end, replaces the crate's regular expression engine, and gives every match of a pattern a limit of time. The functions and types that were there are unchanged, and there are additions for the limit. Versions 0.1.0 to 0.1.3 are affected.
+
+### The regular expression engine
+
+The crate no longer uses the `regress` crate for the patterns with a lookaround, a backreference or a modifier group. It matches them with an engine of its own, a port of the ECMA-262 engine of the Corvus Go module, and matches every pattern as it is written. The crate's [version history](../../src-rs/corvus-json-schema/VERSIONHISTORY.md) lists the patterns that were answered wrongly before (a repetition inside a repetition that lost its count or did not end, a backreference from inside its group, two groups with one name, case-insensitive matching without the `u` flag, a pattern that is valid only without the `u` flag and a character beyond the Basic Multilingual Plane, `\B` beside a character of several bytes, and others), and what was measured: V8's answer for all 4,268,313 texts of the ECMA-262 regular expression test data that can be asked.
+
+### Limits on regular expressions
+
+A schema and an instance may both come from outside, so a pattern is now bounded in what it costs. Nothing that was there has changed. There is one new option and there are two new errors.
+
+- **A match has a limit of one second.** `pattern_match_limit`, a keyword of `CorvusJsonSchema.compile`, is the seconds one match of a `pattern` or `patternProperties` regular expression against one string may take. The default is `CorvusJsonSchema::DEFAULT_PATTERN_MATCH_LIMIT`, `1.0`. `nil` or `0` turns the limit off for a caller who trusts both the schema and the instances. The limit is on each match, not on the validation.
+- **`CorvusJsonSchema::PatternMatchLimitError`** is raised by `valid?`, `valid_json?` and `evaluate` when a match reached the limit, or when its backtracking held 1,048,576 entries. The instance is then neither valid nor not valid. The message names the pattern and the limit. `compile` can raise it too, because a pattern of `patternProperties` is matched against the property names the schema declares.
+- **`CorvusJsonSchema::PatternTooLargeError`** is raised by `compile` for a schema with a regular expression over a limit of size: 1,048,576 bytes of pattern, 1,000 levels of groups, or 1,048,576 counted for it as it is read (a pattern of plain characters can be 16,384 characters long). It is a `CompilationError`, so code that rescues those still does. A regular expression that is not valid raises `CompilationError` itself, as before.
+
+### Bug fixes
+
+- **A separated list with a `$` inside it.** The crate matches a pattern of the form `^item(separator item)*$`, such as `^([a-z]+)(\.[a-z]+)*$`, without a regular expression engine. It dropped a `$` at the end of the first item or of the repeated group, so `^x(,a$)*$` was matched as `^x(,a)*$`. A `$` holds only at the end of the string, so the group of `^x(,a$)*$` can match once at most. `CorvusJsonSchema.compile({ "pattern" => '^x(,a$)*$' }).valid?("x,a,a")` returned `true`, where the instance is not valid. `^x$(,a)*$` took `"x,a"`, and `^(a,$)*b$` took `"a,b"`. `valid?`, `valid_json?` and `evaluate` were all affected, and so was a pattern used for `patternProperties` or `propertyNames`. Such a pattern is now matched by a regular expression engine. An escaped `\$` is a literal character and is matched as before. No other form of pattern was affected. The extension's crate requirement names 0.1.7, so the copy of the crate vendored at build time cannot be an older one.
+
+### Notices
+
+- **The notice of the Unicode data is in the gem.** The Unicode tables of the `corvus-json-schema` crate are derived from the Unicode Character Database, which is under the Unicode License V3. That license asks that its notice goes with every copy of the data. `THIRD-PARTY-NOTICES.txt` has it, with the notice of the `regress` crate that the tables were first read from, and is now in the source gem and in every native gem. Versions 0.1.0 to 0.1.3 carried no such notice.
+
 ## V0.1.3
 
 V0.1.3 fixes `gem install corvus_json_schema` on Alpine Linux and other musl systems, where RubyGems before 4.0 could install the glibc gem, which does not load there. There are no API changes, and the extension is the one in 0.1.2. Versions 0.1.0 to 0.1.2 are affected.

data/lib/corvus_json_schema/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CorvusJsonSchema
-  VERSION = "0.1.3"
+  VERSION = "0.1.4"
 end

data/lib/corvus_json_schema.rb

@@ -25,6 +25,9 @@ module CorvusJsonSchema
     draft4: 4, draft6: 6, draft7: 7, draft201909: 2019, draft202012: 2020
   }.freeze
 
+  # The seconds one match of a regular expression may take, unless compile is told otherwise.
+  DEFAULT_PATTERN_MATCH_LIMIT = 1.0
+
   RESULTS_LEVELS = { basic: 0, detailed: 1, verbose: 2 }.freeze
 
   # Compiles a schema (a Hash or Array, true or false, or JSON text) into a Validator.
@@ -33,12 +36,19 @@ module CorvusJsonSchema
   # $schema), assert_format (nil follows the vocabularies), assert_format_in_legacy_drafts, assert_content, formats (a
   # Hash of format name to a callable returning whether a string is valid), resolver (a callable from an absolute URI
   # to the document, as a Hash or JSON text, or nil when unknown), base_uri, entry_point (a reference such as
-  # "#/$defs/item") and max_depth (of in-place recursion, default 128).
+  # "#/$defs/item"), max_depth (of in-place recursion, default 128) and pattern_match_limit (the seconds one match of
+  # a pattern or patternProperties regular expression may take, default 1. A match that takes longer is abandoned and
+  # the validation raises PatternMatchLimitError. nil or 0 turns the limit off, for a caller who trusts both the
+  # schema and the instances).
+  #
+  # A schema that does not compile raises CompilationError, and one with a regular expression over a limit of size
+  # (1,048,576 bytes of pattern, 1,000 levels of groups) raises PatternTooLargeError, which is a CompilationError.
   def self.compile(schema, default_dialect: :draft202012, assert_format: nil, assert_format_in_legacy_drafts: false,
-                   assert_content: true, formats: nil, resolver: nil, base_uri: nil, entry_point: nil, max_depth: 128)
+                   assert_content: true, formats: nil, resolver: nil, base_uri: nil, entry_point: nil, max_depth: 128,
+                   pattern_match_limit: DEFAULT_PATTERN_MATCH_LIMIT)
     dialect = DIALECTS.fetch(default_dialect) { raise ArgumentError, "unknown dialect #{default_dialect.inspect}" }
     Native.compile(schema, dialect, assert_format, assert_format_in_legacy_drafts, assert_content, formats, resolver,
-                   base_uri, entry_point, Integer(max_depth))
+                   base_uri, entry_point, Integer(max_depth), pattern_match_limit&.to_f)
   end
 
   # The version of the corvus-json-schema crate the extension was built from.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: corvus_json_schema
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.4
 platform: x86_64-linux-gnu
 authors:
 - endjin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-10-12 00:00:00.000000000 Z
+date: 2026-10-17 00:00:00.000000000 Z
 dependencies: []
 description: 'JSON Schema validation for Ruby with the corvus-json-schema Rust crate:
   drafts 4, 6, 7, 2019-09 and 2020-12, results and annotations, Ruby values read in
@@ -20,6 +20,7 @@ extra_rdoc_files: []
 files:
 - LICENSE
 - README.md
+- THIRD-PARTY-NOTICES.txt
 - VERSIONHISTORY.md
 - lib/corvus_json_schema.rb
 - lib/corvus_json_schema/3.3/corvus_json_schema.so