@plasius/schema 1.4.1 → 1.4.2

package/dist/feedback-diagnostics.cjs

@@ -1570,45 +1570,113 @@ function getShape(def) {
 var MAX_STRICT_VALIDATION_NODES = 1e4;
 var MAX_STRICT_VALIDATION_DEPTH = 256;
 var MAX_STRICT_VALIDATION_OBJECTS = MAX_STRICT_VALIDATION_NODES;
-function strictInputIsWithinComplexityLimit(input) {
-  const pending = [
-    { value: input, depth: 0 }
-  ];
+function snapshotStrictInput(input) {
+  const snapshot = Array.isArray(input) ? [] : {};
+  const pending = [{ source: input, target: snapshot, depth: 0 }];
   const seen = /* @__PURE__ */ new WeakSet();
-  let visitedNodes = 0;
+  let visitedNodes = 1;
   try {
     while (pending.length > 0) {
       const current = pending.pop();
       if (!current) {
         continue;
       }
-      visitedNodes += 1;
       if (visitedNodes > MAX_STRICT_VALIDATION_NODES || current.depth > MAX_STRICT_VALIDATION_DEPTH) {
-        return false;
+        return { valid: false };
       }
-      if (typeof current.value !== "object" || current.value === null) {
-        continue;
+      if (seen.has(current.source)) {
+        return { valid: false };
+      }
+      seen.add(current.source);
+      const isArray = Array.isArray(current.source);
+      const prototype = Object.getPrototypeOf(current.source);
+      if (isArray && prototype !== Array.prototype || !isArray && prototype !== Object.prototype && prototype !== null) {
+        return { valid: false };
+      }
+      const ownKeys = Reflect.ownKeys(current.source);
+      if (visitedNodes + ownKeys.length > MAX_STRICT_VALIDATION_NODES) {
+        return { valid: false };
       }
-      if (seen.has(current.value)) {
-        return false;
+      const descriptors = /* @__PURE__ */ new Map();
+      for (const key of ownKeys) {
+        const descriptor = Object.getOwnPropertyDescriptor(
+          current.source,
+          key
+        );
+        if (descriptor === void 0) {
+          return { valid: false };
+        }
+        descriptors.set(key, descriptor);
       }
-      seen.add(current.value);
-      const keys = Object.keys(current.value);
-      if (visitedNodes + pending.length + keys.length > MAX_STRICT_VALIDATION_NODES) {
-        return false;
+      if (isArray) {
+        const lengthDescriptor = descriptors.get("length");
+        if (lengthDescriptor === void 0 || !("value" in lengthDescriptor) || !Number.isSafeInteger(lengthDescriptor.value) || lengthDescriptor.value < 0 || lengthDescriptor.value > MAX_STRICT_VALIDATION_NODES) {
+          return { valid: false };
+        }
+        let elementCount = 0;
+        for (const key of ownKeys) {
+          if (key === "length") {
+            continue;
+          }
+          if (typeof key !== "string" || !/^(?:0|[1-9]\d*)$/.test(key)) {
+            return { valid: false };
+          }
+          const descriptor = descriptors.get(key);
+          if (descriptor === void 0 || descriptor.enumerable !== true || Number(key) >= lengthDescriptor.value) {
+            return { valid: false };
+          }
+          elementCount += 1;
+        }
+        if (elementCount !== lengthDescriptor.value) {
+          return { valid: false };
+        }
       }
-      const record = current.value;
+      visitedNodes += ownKeys.length;
+      const keys = ownKeys.filter(
+        (key) => descriptors.get(key)?.enumerable
+      );
       for (const key of keys) {
-        pending.push({
-          value: record[key],
-          depth: current.depth + 1
+        if (typeof key !== "string") {
+          return { valid: false };
+        }
+        if (isArray && !/^(?:0|[1-9]\d*)$/.test(key)) {
+          return { valid: false };
+        }
+        const descriptor = descriptors.get(key);
+        if (descriptor === void 0 || !("value" in descriptor) || descriptor.get !== void 0 || descriptor.set !== void 0) {
+          return { valid: false };
+        }
+        const child = descriptor.value;
+        if (typeof child === "function") {
+          return { valid: false };
+        }
+        if (typeof child === "object" && child !== null) {
+          const childSnapshot = Array.isArray(child) ? [] : {};
+          Object.defineProperty(current.target, key, {
+            value: childSnapshot,
+            enumerable: true,
+            configurable: true,
+            writable: true
+          });
+          pending.push({
+            source: child,
+            target: childSnapshot,
+            depth: current.depth + 1
+          });
+          continue;
+        }
+        Object.defineProperty(current.target, key, {
+          value: child,
+          enumerable: true,
+          configurable: true,
+          writable: true
         });
       }
     }
   } catch {
-    return false;
+    return { valid: false };
   }
-  return true;
+  return { valid: true, value: snapshot };
 }
 function strictReferenceShape(def) {
   return {
@@ -2175,8 +2243,10 @@ function createSchema(_shape, entityType, options = {
       if (typeof input !== "object" || input === null) {
         return { valid: false, errors: ["Input must be an object"] };
       }
+      let strictInputSnapshot;
       if (options.unknownFields === "reject") {
-        if (!strictInputIsWithinComplexityLimit(input)) {
+        const snapshot = snapshotStrictInput(input);
+        if (!snapshot.valid) {
           return {
             valid: false,
             errors: ["Strict validation complexity limit exceeded."],
@@ -2189,16 +2259,32 @@ function createSchema(_shape, entityType, options = {
             ]
           };
         }
+        strictInputSnapshot = snapshot.value;
         const scanState = {
           remainingObjects: MAX_STRICT_VALIDATION_OBJECTS,
           limitExceeded: false
         };
-        const locations = unknownFieldLocations(
-          input,
-          schema._shape,
-          "root",
-          scanState
-        );
+        let locations;
+        try {
+          locations = unknownFieldLocations(
+            strictInputSnapshot,
+            schema._shape,
+            "root",
+            scanState
+          );
+        } catch {
+          return {
+            valid: false,
+            errors: ["Strict validation complexity limit exceeded."],
+            issues: [
+              {
+                path: "root",
+                code: "validation_complexity_limit",
+                message: "Strict validation complexity limit exceeded."
+              }
+            ]
+          };
+        }
         if (scanState.limitExceeded) {
           return {
             valid: false,
@@ -2226,7 +2312,23 @@ function createSchema(_shape, entityType, options = {
           };
         }
       }
-      const working = typeof input === "object" && input !== null ? deepClone(input) : { ...input };
+      let working;
+      try {
+        working = strictInputSnapshot ?? (typeof input === "object" && input !== null ? deepClone(input) : { ...input });
+      } catch {
+        return {
+          valid: false,
+          errors: ["Input could not be safely cloned."],
+          issues: [
+            {
+              path: "root",
+              code: "unsafe_input",
+              message: "Input could not be safely cloned."
+            }
+          ]
+        };
+      }
+      const providedFieldNames = new Set(Object.keys(working));
       if (working.type == null) working.type = entityType;
       if (working.version == null) working.version = version;
       const fromVersion = String(working.version ?? "0.0.0");
@@ -2343,9 +2445,8 @@ function createSchema(_shape, entityType, options = {
       }
       if (errors.length === 0 && options.schemaValidator) {
         const castValue = result;
-        const source = input;
         const validationContext = Object.freeze({
-          wasProvided: (fieldName) => Object.prototype.hasOwnProperty.call(source, fieldName)
+          wasProvided: (fieldName) => providedFieldNames.has(fieldName)
         });
         if (!options.schemaValidator(castValue, validationContext)) {
           errors.push("Schema-level validation failed.");