@apidevtools/json-schema-ref-parser 11.9.3 → 12.0.1

package/dist/lib/dereference.js

@@ -76,11 +76,7 @@ function crawl(obj, path, pathFromRoot, parents, processedObjects, dereferencedC
         value: obj,
         circular: false,
     };
-    if (options && options.timeoutMs) {
-        if (Date.now() - startTime > options.timeoutMs) {
-            throw new errors_1.TimeoutError(options.timeoutMs);
-        }
-    }
+    checkDereferenceTimeout(startTime, options);
     const derefOptions = (options.dereference || {});
     const isExcludedPath = derefOptions.excludedPathMatcher || (() => false);
     if (derefOptions?.circular === "ignore" || !processedObjects.has(obj)) {
@@ -94,6 +90,7 @@ function crawl(obj, path, pathFromRoot, parents, processedObjects, dereferencedC
             }
             else {
                 for (const key of Object.keys(obj)) {
+                    checkDereferenceTimeout(startTime, options);
                     const keyPath = pointer_js_1.default.join(path, key);
                     const keyPathFromRoot = pointer_js_1.default.join(pathFromRoot, key);
                     if (isExcludedPath(keyPathFromRoot)) {
@@ -171,22 +168,52 @@ function dereference$Ref($ref, path, pathFromRoot, parents, processedObjects, de
     const shouldResolveOnCwd = isExternalRef && options?.dereference?.externalReferenceResolution === "root";
     const $refPath = url.resolve(shouldResolveOnCwd ? url.cwd() : path, $ref.$ref);
     const cache = dereferencedCache.get($refPath);
-    if (cache && !cache.circular) {
-        const refKeys = Object.keys($ref);
-        if (refKeys.length > 1) {
-            const extraKeys = {};
-            for (const key of refKeys) {
-                if (key !== "$ref" && !(key in cache.value)) {
-                    // @ts-expect-error TS(7053): Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
-                    extraKeys[key] = $ref[key];
+    if (cache) {
+        // If the object we found is circular we can immediately return it because it would have been
+        // cached with everything we need already and we don't need to re-process anything inside it.
+        //
+        // If the cached object however is _not_ circular and there are additional keys alongside our
+        // `$ref` pointer here we should merge them back in and return that.
+        if (!cache.circular) {
+            const refKeys = Object.keys($ref);
+            if (refKeys.length > 1) {
+                const extraKeys = {};
+                for (const key of refKeys) {
+                    if (key !== "$ref" && !(key in cache.value)) {
+                        // @ts-expect-error TS(7053): Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
+                        extraKeys[key] = $ref[key];
+                    }
                 }
+                return {
+                    circular: cache.circular,
+                    value: Object.assign({}, cache.value, extraKeys),
+                };
             }
-            return {
-                circular: cache.circular,
-                value: Object.assign({}, cache.value, extraKeys),
-            };
+            return cache;
+        }
+        // If both our cached value and our incoming `$ref` are the same then we can return what we
+        // got out of the cache, otherwise we should re-process this value. We need to do this because
+        // the current dereference caching mechanism doesn't take into account that `$ref` are neither
+        // unique or reference the same file.
+        //
+        // For example if `schema.yaml` references `definitions/child.yaml` and
+        // `definitions/parent.yaml` references `child.yaml` then `$ref: 'child.yaml'` may get cached
+        // for `definitions/child.yaml`, resulting in `schema.yaml` being having an invalid reference
+        // to `child.yaml`.
+        //
+        // This check is not perfect and the design of the dereference caching mechanism needs a total
+        // overhaul.
+        if (typeof cache.value === 'object' && '$ref' in cache.value && '$ref' in $ref) {
+            if (cache.value.$ref === $ref.$ref) {
+                return cache;
+            }
+            else {
+                // no-op
+            }
+        }
+        else {
+            return cache;
         }
-        return cache;
     }
     const pointer = $refs._resolve($refPath, path, options);
     if (pointer === null) {
@@ -229,6 +256,19 @@ function dereference$Ref($ref, path, pathFromRoot, parents, processedObjects, de
     }
     return dereferencedObject;
 }
+/**
+ * Check if we've run past our allowed timeout and throw an error if we have.
+ *
+ * @param startTime - The time when the dereferencing started.
+ * @param options
+ */
+function checkDereferenceTimeout(startTime, options) {
+    if (options && options.timeoutMs) {
+        if (Date.now() - startTime > options.timeoutMs) {
+            throw new errors_1.TimeoutError(options.timeoutMs);
+        }
+    }
+}
 /**
  * Called when a circular reference is found.
  * It sets the {@link $Refs#circular} flag, executes the options.dereference.onCircular callback,

package/lib/dereference.ts

@@ -69,11 +69,8 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
     circular: false,
   };
 
-  if (options && options.timeoutMs) {
-    if (Date.now() - startTime > options.timeoutMs) {
-      throw new TimeoutError(options.timeoutMs);
-    }
-  }
+  checkDereferenceTimeout<S, O>(startTime, options);
+
   const derefOptions = (options.dereference || {}) as DereferenceOptions;
   const isExcludedPath = derefOptions.excludedPathMatcher || (() => false);
 
@@ -98,6 +95,8 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
         result.value = dereferenced.value;
       } else {
         for (const key of Object.keys(obj)) {
+          checkDereferenceTimeout<S, O>(startTime, options);
+
           const keyPath = Pointer.join(path, key);
           const keyPathFromRoot = Pointer.join(pathFromRoot, key);
 
@@ -214,23 +213,53 @@ function dereference$Ref<S extends object = JSONSchema, O extends ParserOptions<
   const $refPath = url.resolve(shouldResolveOnCwd ? url.cwd() : path, $ref.$ref);
 
   const cache = dereferencedCache.get($refPath);
-  if (cache && !cache.circular) {
-    const refKeys = Object.keys($ref);
-    if (refKeys.length > 1) {
-      const extraKeys = {};
-      for (const key of refKeys) {
-        if (key !== "$ref" && !(key in cache.value)) {
-          // @ts-expect-error TS(7053): Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
-          extraKeys[key] = $ref[key];
+
+  if (cache) {
+    // If the object we found is circular we can immediately return it because it would have been
+    // cached with everything we need already and we don't need to re-process anything inside it.
+    //
+    // If the cached object however is _not_ circular and there are additional keys alongside our
+    // `$ref` pointer here we should merge them back in and return that.
+    if (!cache.circular) {
+      const refKeys = Object.keys($ref);
+      if (refKeys.length > 1) {
+        const extraKeys = {};
+        for (const key of refKeys) {
+          if (key !== "$ref" && !(key in cache.value)) {
+            // @ts-expect-error TS(7053): Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
+            extraKeys[key] = $ref[key];
+          }
         }
+        return {
+          circular: cache.circular,
+          value: Object.assign({}, cache.value, extraKeys),
+        };
       }
-      return {
-        circular: cache.circular,
-        value: Object.assign({}, cache.value, extraKeys),
-      };
+
+      return cache;
     }
 
-    return cache;
+    // If both our cached value and our incoming `$ref` are the same then we can return what we
+    // got out of the cache, otherwise we should re-process this value. We need to do this because
+    // the current dereference caching mechanism doesn't take into account that `$ref` are neither
+    // unique or reference the same file.
+    //
+    // For example if `schema.yaml` references `definitions/child.yaml` and
+    // `definitions/parent.yaml` references `child.yaml` then `$ref: 'child.yaml'` may get cached
+    // for `definitions/child.yaml`, resulting in `schema.yaml` being having an invalid reference
+    // to `child.yaml`.
+    //
+    // This check is not perfect and the design of the dereference caching mechanism needs a total
+    // overhaul.
+    if (typeof cache.value === 'object' && '$ref' in cache.value && '$ref' in $ref) {
+      if (cache.value.$ref === $ref.$ref) {
+        return cache;
+      } else {
+        // no-op
+      }
+    } else {
+      return cache;
+    }
   }
 
   const pointer = $refs._resolve($refPath, path, options);
@@ -294,6 +323,23 @@ function dereference$Ref<S extends object = JSONSchema, O extends ParserOptions<
   return dereferencedObject;
 }
 
+/**
+ * Check if we've run past our allowed timeout and throw an error if we have.
+ *
+ * @param startTime - The time when the dereferencing started.
+ * @param options
+ */
+function checkDereferenceTimeout<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
+  startTime: number,
+  options: O,
+): void {
+  if (options && options.timeoutMs) {
+    if (Date.now() - startTime > options.timeoutMs) {
+      throw new TimeoutError(options.timeoutMs);
+    }
+  }
+}
+
 /**
  * Called when a circular reference is found.
  * It sets the {@link $Refs#circular} flag, executes the options.dereference.onCircular callback,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apidevtools/json-schema-ref-parser",
-  "version": "11.9.3",
+  "version": "12.0.1",
   "description": "Parse, Resolve, and Dereference JSON Schema $ref pointers",
   "scripts": {
     "prepublishOnly": "yarn build",