@apidevtools/json-schema-ref-parser 15.3.4 → 15.3.5

package/dist/lib/bundle.js

@@ -12,9 +12,12 @@ import { getSchemaBasePath } from "./util/schema-resources.js";
  */
 function bundle(parser, options) {
     // console.log('Bundling $ref pointers in %s', parser.$refs._root$Ref.path);
+    const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+        ? getSchemaBasePath(parser.$refs._root$Ref.path, parser.schema)
+        : parser.$refs._root$Ref.path;
     // Build an inventory of all $ref pointers in the JSON Schema
     const inventory = [];
-    crawl(parser, "schema", parser.$refs._root$Ref.path + "#", parser.$refs._root$Ref.path, parser.$refs._root$Ref.dynamicIdScope, "#", 0, inventory, parser.$refs, options);
+    crawl(parser, "schema", parser.$refs._root$Ref.path + "#", rootScopeBase, parser.$refs._root$Ref.dynamicIdScope, "#", 0, inventory, parser.$refs, options);
     // Get the root schema's $id (if any) for qualifying refs inside sub-schemas with their own $id
     const rootId = parser.schema && typeof parser.schema === "object" && "$id" in parser.schema
         ? parser.schema.$id
@@ -44,7 +47,7 @@ function crawl(parent, key, path, scopeBase, dynamicIdScope, pathFromRoot, indir
     const bundleOptions = (options.bundle || {});
     const isExcludedPath = bundleOptions.excludedPathMatcher || (() => false);
     if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !isExcludedPath(pathFromRoot)) {
-        const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+        const currentScopeBase = scopeBase;
         if ($Ref.isAllowed$Ref(obj)) {
             inventory$Ref(parent, key, path, currentScopeBase, dynamicIdScope, pathFromRoot, indirections, inventory, $refs, options);
         }
@@ -71,12 +74,14 @@ function crawl(parent, key, path, scopeBase, dynamicIdScope, pathFromRoot, indir
                 const keyPath = Pointer.join(path, key);
                 const keyPathFromRoot = Pointer.join(pathFromRoot, key);
                 const value = obj[key];
+                const childScopeBase = dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+                    ? getSchemaBasePath(currentScopeBase, value)
+                    : currentScopeBase;
                 if ($Ref.isAllowed$Ref(value)) {
-                    const valueScopeBase = dynamicIdScope ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
-                    inventory$Ref(obj, key, keyPath, valueScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
+                    inventory$Ref(obj, key, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
                 }
                 else {
-                    crawl(obj, key, keyPath, currentScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
+                    crawl(obj, key, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
                 }
                 // We need to ensure that we have an object to work with here because we may be crawling
                 // an `examples` schema and `value` may be nullish.

package/dist/lib/dereference.js

@@ -13,8 +13,11 @@ export default dereference;
  */
 function dereference(parser, options) {
     const start = Date.now();
+    const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+        ? getSchemaBasePath(parser.$refs._root$Ref.path, parser.schema)
+        : parser.$refs._root$Ref.path;
     // console.log('Dereferencing $ref pointers in %s', parser.$refs._root$Ref.path);
-    const dereferenced = crawl(parser.schema, parser.$refs._root$Ref.path, parser.$refs._root$Ref.path, parser.$refs._root$Ref.dynamicIdScope, "#", new Set(), new Set(), new Map(), parser.$refs, options, start, 0);
+    const dereferenced = crawl(parser.schema, parser.$refs._root$Ref.path, rootScopeBase, parser.$refs._root$Ref.dynamicIdScope, "#", new Set(), new Set(), new Map(), parser.$refs, options, start, 0);
     parser.$refs.circular = dereferenced.circular;
     parser.schema = dereferenced.value;
 }
@@ -52,7 +55,7 @@ function crawl(obj, path, scopeBase, dynamicIdScope, pathFromRoot, parents, proc
         if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !isExcludedPath(pathFromRoot)) {
             parents.add(obj);
             processedObjects.add(obj);
-            const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+            const currentScopeBase = scopeBase;
             if ($Ref.isAllowed$Ref(obj, options)) {
                 dereferenced = dereference$Ref(obj, path, currentScopeBase, dynamicIdScope, pathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth);
                 result.circular = dereferenced.circular;
@@ -67,10 +70,12 @@ function crawl(obj, path, scopeBase, dynamicIdScope, pathFromRoot, parents, proc
                         continue;
                     }
                     const value = obj[key];
+                    const childScopeBase = dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+                        ? getSchemaBasePath(currentScopeBase, value)
+                        : currentScopeBase;
                     let circular;
                     if ($Ref.isAllowed$Ref(value, options)) {
-                        const valueScopeBase = dynamicIdScope ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
-                        dereferenced = dereference$Ref(value, keyPath, valueScopeBase, dynamicIdScope, keyPathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth);
+                        dereferenced = dereference$Ref(value, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth);
                         circular = dereferenced.circular;
                         // Avoid pointless mutations; breaks frozen objects to no profit
                         if (obj[key] !== dereferenced.value) {
@@ -107,7 +112,7 @@ function crawl(obj, path, scopeBase, dynamicIdScope, pathFromRoot, parents, proc
                     }
                     else {
                         if (!parents.has(value)) {
-                            dereferenced = crawl(value, keyPath, currentScopeBase, dynamicIdScope, keyPathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth + 1);
+                            dereferenced = crawl(value, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth + 1);
                             circular = dereferenced.circular;
                             // Avoid pointless mutations; breaks frozen objects to no profit
                             if (obj[key] !== dereferenced.value) {

package/dist/lib/pointer.js

@@ -74,7 +74,7 @@ class Pointer {
         const found = [];
         // Crawl the object, one token at a time
         this.value = unwrapOrThrow(obj);
-        if (this.$ref.dynamicIdScope) {
+        if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
             this.scopeBase = getSchemaBasePath(this.scopeBase, this.value);
         }
         for (let i = 0; i < tokens.length; i++) {
@@ -163,7 +163,7 @@ class Pointer {
         }
         // Crawl the object, one token at a time
         this.value = unwrapOrThrow(obj);
-        if (this.$ref.dynamicIdScope) {
+        if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
             this.scopeBase = getSchemaBasePath(this.scopeBase, this.value);
         }
         for (let i = 0; i < tokens.length - 1; i++) {
@@ -273,9 +273,6 @@ function resolveIf$Ref(pointer, options, pathFromRoot) {
                 // This JSON reference "extends" the resolved value, rather than simply pointing to it.
                 // So the resolved path does NOT change.  Just the value does.
                 pointer.value = $Ref.dereference(pointer.value, resolved.value, options);
-                if (pointer.$ref.dynamicIdScope) {
-                    pointer.scopeBase = getSchemaBasePath(pointer.scopeBase, pointer.value);
-                }
                 return false;
             }
             else {
@@ -283,9 +280,10 @@ function resolveIf$Ref(pointer, options, pathFromRoot) {
                 pointer.$ref = resolved.$ref;
                 pointer.path = resolved.path;
                 pointer.value = resolved.value;
-                pointer.scopeBase = pointer.$ref.dynamicIdScope
-                    ? getSchemaBasePath(pointer.$ref.path, pointer.value)
-                    : pointer.$ref.path;
+                // `pointer.$ref.path` is already the canonical location of the resolved resource.
+                // Re-applying the resource's own `$id` here would duplicate nested path segments
+                // such as `nested/nested/foo.json`.
+                pointer.scopeBase = pointer.$ref.path;
             }
             return true;
         }
@@ -327,3 +325,6 @@ function unwrapOrThrow(value) {
 function isRootPath(pathFromRoot) {
     return typeof pathFromRoot == "string" && Pointer.parse(pathFromRoot).length == 0;
 }
+function isAliasedResource($ref) {
+    return Boolean($ref.path && $ref.path in $ref.$refs._aliases);
+}

package/dist/lib/resolve-external.js

@@ -20,8 +20,11 @@ function resolveExternal(parser, options) {
         return Promise.resolve();
     }
     try {
+        const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+            ? getSchemaBasePath(parser.$refs._root$Ref.path, parser.schema)
+            : parser.$refs._root$Ref.path;
         // console.log('Resolving $ref pointers in %s', parser.$refs._root$Ref.path);
-        const promises = crawl(parser.schema, parser.$refs._root$Ref.path + "#", parser.$refs._root$Ref.path, parser.$refs._root$Ref.dynamicIdScope, parser.$refs, options);
+        const promises = crawl(parser.schema, parser.$refs._root$Ref.path + "#", rootScopeBase, parser.$refs._root$Ref.dynamicIdScope, parser.$refs, options);
         return Promise.all(promises);
     }
     catch (e) {
@@ -49,7 +52,7 @@ function crawl(obj, path, scopeBase, dynamicIdScope, $refs, options, seen, exter
     let promises = [];
     if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !seen.has(obj)) {
         seen.add(obj); // Track previously seen objects to avoid infinite recursion
-        const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+        const currentScopeBase = scopeBase;
         if ($Ref.isExternal$Ref(obj)) {
             promises.push(resolve$Ref(obj, path, currentScopeBase, dynamicIdScope, $refs, options));
         }
@@ -57,7 +60,9 @@ function crawl(obj, path, scopeBase, dynamicIdScope, $refs, options, seen, exter
         for (const key of keys) {
             const keyPath = Pointer.join(path, key);
             const value = obj[key];
-            const childScopeBase = dynamicIdScope && $Ref.isExternal$Ref(value) ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
+            const childScopeBase = dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+                ? getSchemaBasePath(currentScopeBase, value)
+                : currentScopeBase;
             promises = promises.concat(crawl(value, keyPath, childScopeBase, dynamicIdScope, $refs, options, seen, external));
         }
     }

package/dist/lib/util/url.js

@@ -4,7 +4,7 @@ const protocolPattern = /^(\w{2,}):\/\//i;
 const jsonPointerSlash = /~1/g;
 const jsonPointerTilde = /~0/g;
 import { isWindows } from "./is-windows.js";
-const isAbsoluteWin32Path = /^[a-zA-Z]:\\/;
+const isAbsoluteWin32Path = /^[a-zA-Z]:[\\/]/;
 // RegExp patterns to URL-encode special characters in local filesystem paths
 const urlEncodePatterns = [
     [/\?/g, "%3F"],
@@ -381,6 +381,9 @@ export function fromFileSystemPath(path) {
  * Converts a URL to a local filesystem path.
  */
 export function toFileSystemPath(path, keepFileProtocol) {
+    // Bare "%" characters are valid in filesystem paths, but they make `decodeURI` throw.
+    // Escape only the non-encoded ones so percent-encoded sequences still decode normally.
+    path = path.replace(/%(?![0-9A-Fa-f]{2})/g, "%25");
     // Step 1: `decodeURI` will decode characters such as Cyrillic characters, spaces, etc.
     path = decodeURI(path);
     // Step 2: Manually decode characters that are not decoded by `decodeURI`.

package/lib/bundle.ts

@@ -35,6 +35,9 @@ function bundle<S extends object = JSONSchema, O extends ParserOptions<S> = Pars
   options: O,
 ) {
   // console.log('Bundling $ref pointers in %s', parser.$refs._root$Ref.path);
+  const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+    ? getSchemaBasePath(parser.$refs._root$Ref.path!, parser.schema)
+    : parser.$refs._root$Ref.path!;
 
   // Build an inventory of all $ref pointers in the JSON Schema
   const inventory: InventoryEntry[] = [];
@@ -42,7 +45,7 @@ function bundle<S extends object = JSONSchema, O extends ParserOptions<S> = Pars
     parser,
     "schema",
     parser.$refs._root$Ref.path + "#",
-    parser.$refs._root$Ref.path!,
+    rootScopeBase,
     parser.$refs._root$Ref.dynamicIdScope,
     "#",
     0,
@@ -96,7 +99,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
   const isExcludedPath = bundleOptions.excludedPathMatcher || (() => false);
 
   if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !isExcludedPath(pathFromRoot)) {
-    const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+    const currentScopeBase = scopeBase;
     if ($Ref.isAllowed$Ref(obj)) {
       inventory$Ref(parent, key, path, currentScopeBase, dynamicIdScope, pathFromRoot, indirections, inventory, $refs, options);
     } else {
@@ -121,14 +124,17 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
         const keyPath = Pointer.join(path, key);
         const keyPathFromRoot = Pointer.join(pathFromRoot, key);
         const value = obj[key];
+        const childScopeBase =
+          dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+            ? getSchemaBasePath(currentScopeBase, value)
+            : currentScopeBase;
 
         if ($Ref.isAllowed$Ref(value)) {
-          const valueScopeBase = dynamicIdScope ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
           inventory$Ref(
             obj,
             key,
             keyPath,
-            valueScopeBase,
+            childScopeBase,
             dynamicIdScope,
             keyPathFromRoot,
             indirections,
@@ -137,7 +143,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
             options,
           );
         } else {
-          crawl(obj, key, keyPath, currentScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
+          crawl(obj, key, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
         }
 
         // We need to ensure that we have an object to work with here because we may be crawling

package/lib/dereference.ts

@@ -21,11 +21,14 @@ function dereference<S extends object = JSONSchema, O extends ParserOptions<S> =
   options: O,
 ) {
   const start = Date.now();
+  const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+    ? getSchemaBasePath(parser.$refs._root$Ref.path!, parser.schema)
+    : parser.$refs._root$Ref.path!;
   // console.log('Dereferencing $ref pointers in %s', parser.$refs._root$Ref.path);
   const dereferenced = crawl<S, O>(
     parser.schema,
     parser.$refs._root$Ref.path!,
-    parser.$refs._root$Ref.path!,
+    rootScopeBase,
     parser.$refs._root$Ref.dynamicIdScope,
     "#",
     new Set(),
@@ -92,7 +95,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
     if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !isExcludedPath(pathFromRoot)) {
       parents.add(obj);
       processedObjects.add(obj);
-      const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+      const currentScopeBase = scopeBase;
 
       if ($Ref.isAllowed$Ref(obj, options)) {
         dereferenced = dereference$Ref(
@@ -123,14 +126,17 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
           }
 
           const value = obj[key];
+          const childScopeBase =
+            dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+              ? getSchemaBasePath(currentScopeBase, value)
+              : currentScopeBase;
           let circular;
 
           if ($Ref.isAllowed$Ref(value, options)) {
-            const valueScopeBase = dynamicIdScope ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
             dereferenced = dereference$Ref(
               value,
               keyPath,
-              valueScopeBase,
+              childScopeBase,
               dynamicIdScope,
               keyPathFromRoot,
               parents,
@@ -183,7 +189,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
               dereferenced = crawl(
                 value,
                 keyPath,
-                currentScopeBase,
+                childScopeBase,
                 dynamicIdScope,
                 keyPathFromRoot,
                 parents,

package/lib/pointer.ts

@@ -95,7 +95,7 @@ class Pointer<S extends object = JSONSchema, O extends ParserOptions<S> = Parser
 
     // Crawl the object, one token at a time
     this.value = unwrapOrThrow(obj);
-    if (this.$ref.dynamicIdScope) {
+    if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
       this.scopeBase = getSchemaBasePath(this.scopeBase, this.value);
     }
 
@@ -196,7 +196,7 @@ class Pointer<S extends object = JSONSchema, O extends ParserOptions<S> = Parser
 
     // Crawl the object, one token at a time
     this.value = unwrapOrThrow(obj);
-    if (this.$ref.dynamicIdScope) {
+    if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
       this.scopeBase = getSchemaBasePath(this.scopeBase, this.value);
     }
 
@@ -327,18 +327,16 @@ function resolveIf$Ref<S extends object = JSONSchema, O extends ParserOptions<S>
         // This JSON reference "extends" the resolved value, rather than simply pointing to it.
         // So the resolved path does NOT change.  Just the value does.
         pointer.value = $Ref.dereference(pointer.value, resolved.value, options);
-        if (pointer.$ref.dynamicIdScope) {
-          pointer.scopeBase = getSchemaBasePath(pointer.scopeBase, pointer.value);
-        }
         return false;
       } else {
         // Resolve the reference
         pointer.$ref = resolved.$ref;
         pointer.path = resolved.path;
         pointer.value = resolved.value;
-        pointer.scopeBase = pointer.$ref.dynamicIdScope
-          ? getSchemaBasePath(pointer.$ref.path!, pointer.value)
-          : pointer.$ref.path!;
+        // `pointer.$ref.path` is already the canonical location of the resolved resource.
+        // Re-applying the resource's own `$id` here would duplicate nested path segments
+        // such as `nested/nested/foo.json`.
+        pointer.scopeBase = pointer.$ref.path!;
       }
 
       return true;
@@ -385,3 +383,7 @@ function unwrapOrThrow(value: unknown) {
 function isRootPath(pathFromRoot: string | unknown): boolean {
   return typeof pathFromRoot == "string" && Pointer.parse(pathFromRoot).length == 0;
 }
+
+function isAliasedResource($ref: $Ref<any, any>) {
+  return Boolean($ref.path && $ref.path in $ref.$refs._aliases);
+}

package/lib/resolve-external.ts

@@ -29,11 +29,14 @@ function resolveExternal<S extends object = JSONSchema, O extends ParserOptions<
   }
 
   try {
+    const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+      ? getSchemaBasePath(parser.$refs._root$Ref.path!, parser.schema)
+      : parser.$refs._root$Ref.path!;
     // console.log('Resolving $ref pointers in %s', parser.$refs._root$Ref.path);
     const promises = crawl(
       parser.schema,
       parser.$refs._root$Ref.path + "#",
-      parser.$refs._root$Ref.path!,
+      rootScopeBase,
       parser.$refs._root$Ref.dynamicIdScope,
       parser.$refs,
       options,
@@ -75,7 +78,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
 
   if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !seen.has(obj)) {
     seen.add(obj); // Track previously seen objects to avoid infinite recursion
-    const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+    const currentScopeBase = scopeBase;
     if ($Ref.isExternal$Ref(obj)) {
       promises.push(resolve$Ref<S, O>(obj, path, currentScopeBase, dynamicIdScope, $refs, options));
     }
@@ -85,7 +88,9 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
       const keyPath = Pointer.join(path, key);
       const value = obj[key as keyof typeof obj] as string | JSONSchema | Buffer | undefined;
       const childScopeBase =
-        dynamicIdScope && $Ref.isExternal$Ref(value) ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
+        dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+          ? getSchemaBasePath(currentScopeBase, value)
+          : currentScopeBase;
       promises = promises.concat(crawl(value, keyPath, childScopeBase, dynamicIdScope, $refs, options, seen, external));
     }
   }

package/lib/util/url.ts

@@ -7,7 +7,7 @@ const jsonPointerTilde = /~0/g;
 
 import { isWindows } from "./is-windows.js";
 
-const isAbsoluteWin32Path = /^[a-zA-Z]:\\/;
+const isAbsoluteWin32Path = /^[a-zA-Z]:[\\/]/;
 
 // RegExp patterns to URL-encode special characters in local filesystem paths
 const urlEncodePatterns = [
@@ -426,6 +426,10 @@ export function fromFileSystemPath(path: string) {
  * Converts a URL to a local filesystem path.
  */
 export function toFileSystemPath(path: string | undefined, keepFileProtocol?: boolean): string {
+  // Bare "%" characters are valid in filesystem paths, but they make `decodeURI` throw.
+  // Escape only the non-encoded ones so percent-encoded sequences still decode normally.
+  path = path!.replace(/%(?![0-9A-Fa-f]{2})/g, "%25");
+
   // Step 1: `decodeURI` will decode characters such as Cyrillic characters, spaces, etc.
   path = decodeURI(path!);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apidevtools/json-schema-ref-parser",
-  "version": "15.3.4",
+  "version": "15.3.5",
   "description": "Parse, Resolve, and Dereference JSON Schema $ref pointers",
   "type": "module",
   "types": "dist/lib/index.d.ts",
@@ -15,7 +15,7 @@
     "test": "vitest --coverage",
     "test:specific": "vitest invalid",
     "test:node": "yarn test",
-    "test:browser": "cross-env BROWSER=\"true\" yarn test",
+    "test:browser": "node ./test/fixtures/run-browser-tests.mjs",
     "test:update": "vitest -u",
     "test:watch": "vitest -w"
   },