adapt-schemas 3.1.1 → 3.1.2

package/lib/Schema.js

@@ -45,12 +45,6 @@ class Schema extends EventEmitter {
      */
     this.enableCache = enableCache
 
-    /**
-     * List of extensions for this schema
-     * @type {string[]}
-     */
-    this.extensions = []
-
     /**
      * File path to the schema
      * @type {string}
@@ -195,14 +189,13 @@ class Schema extends EventEmitter {
       parent = parent.getParent()
     }
 
-    if (this.extensions.length) {
-      this.extensions.forEach(s => {
-        const applyPatch = typeof extensionFilter === 'function' ? extensionFilter(s) : applyExtensions !== false
-        if (!applyPatch) return
-        const extSchema = this.schemaLibrary.getSchema(s)
-        this.patch(built, extSchema.raw, { extendAnnotations: false })
-      })
-    }
+    const extensions = this.schemaLibrary.schemaExtensions?.[this.name] ?? []
+    extensions.forEach(s => {
+      const applyPatch = typeof extensionFilter === 'function' ? extensionFilter(s) : applyExtensions !== false
+      if (!applyPatch) return
+      const extSchema = this.schemaLibrary.getSchema(s)
+      this.patch(built, extSchema.raw, { extendAnnotations: false })
+    })
 
     this.built = built
 
@@ -355,13 +348,14 @@ class Schema extends EventEmitter {
   }
 
   /**
-   * Adds an extension schema
-   * @param {string} extSchemaName Extension schema name
+   * Discards any cached build/compiled state. Called when an extension is added
+   * or removed against this schema so the next `build()` reflects the change.
    */
-  addExtension (extSchemaName) {
-    if (!this.extensions.includes(extSchemaName)) {
-      this.extensions.push(extSchemaName)
-    }
+  invalidateBuild () {
+    this.built = undefined
+    this.compiled = undefined
+    this.compiledWithDefaults = undefined
+    this.lastBuildTime = undefined
   }
 
   /**

package/lib/Schemas.js

@@ -42,7 +42,7 @@ class Schemas extends EventEmitter {
     this.schemas = {}
 
     /**
-     * Temporary store of extension schemas
+     * Maps base schema name to the names of schemas that extend it (via $patch).
      * @type {Object<string, string[]>}
      */
     this.schemaExtensions = {}
@@ -119,6 +119,7 @@ class Schemas extends EventEmitter {
     this.schemas = {
       base: this.createSchema(path.resolve(__dirname, BASE_SCHEMA_PATH), { enableCache: true })
     }
+    this.schemaExtensions = {}
     this.emit('reset')
   }
 
@@ -240,8 +241,6 @@ class Schemas extends EventEmitter {
       }
     }
 
-    this.schemaExtensions?.[schema.name]?.forEach(s => schema.addExtension(s))
-
     if (schema.raw.$patch) {
       this.extendSchema(schema.raw.$patch?.source?.$ref, schema.name)
     }
@@ -255,17 +254,16 @@ class Schemas extends EventEmitter {
    * @param {string} name Schema name to deregister
    */
   deregisterSchema (name) {
-    if (this.schemas[name]) {
-      delete this.schemas[name]
-    }
-    // Remove from AJV instances
+    delete this.schemas[name]
     for (const v of [this.validator, this.validatorWithDefaults]) {
       if (v.getSchema(name)) v.removeSchema(name)
     }
-    // Remove schema from any extensions lists
-    Object.entries(this.schemaExtensions).forEach(([base, extensions]) => {
+    delete this.schemaExtensions[name]
+    for (const [base, extensions] of Object.entries(this.schemaExtensions)) {
+      if (!extensions.includes(name)) continue
       this.schemaExtensions[base] = extensions.filter(s => s !== name)
-    })
+      this.schemas[base]?.invalidateBuild()
+    }
     this.emit('schemaDeregistered', name)
   }
 
@@ -286,9 +284,6 @@ class Schemas extends EventEmitter {
       ...options
     })
 
-    this.schemaExtensions?.[schema.name]?.forEach(s => schema.addExtension(s))
-    delete this.schemaExtensions?.[schema.name]
-
     return schema.load()
   }
 
@@ -298,14 +293,12 @@ class Schemas extends EventEmitter {
    * @param {string} extSchemaName The name of the schema to extend with
    */
   extendSchema (baseSchemaName, extSchemaName) {
-    const baseSchema = this.schemas[baseSchemaName]
-    if (baseSchema) {
-      baseSchema.addExtension(extSchemaName)
-    } else {
-      if (!this.schemaExtensions[baseSchemaName]) {
-        this.schemaExtensions[baseSchemaName] = []
-      }
+    if (!this.schemaExtensions[baseSchemaName]) {
+      this.schemaExtensions[baseSchemaName] = []
+    }
+    if (!this.schemaExtensions[baseSchemaName].includes(extSchemaName)) {
       this.schemaExtensions[baseSchemaName].push(extSchemaName)
+      this.schemas[baseSchemaName]?.invalidateBuild()
     }
     this.emit('schemaExtended', baseSchemaName, extSchemaName)
   }
@@ -314,7 +307,7 @@ class Schemas extends EventEmitter {
    * Retrieves the specified schema
    * @param {string} schemaName The name of the schema to return
    * @param {Object} options
-   * @param {boolean} options.useCache Use cached build if available
+   * @param {boolean} options.useCache When false, builds into a fresh isolated Schema instance so per-call options (extensionFilter, applyExtensions) don't mutate the registry's build state (default: true)
    * @param {boolean} options.compile Compile the schema (default: true)
    * @param {boolean} options.applyExtensions Apply extension schemas (default: true)
    * @param {function} options.extensionFilter Filter function for extensions
@@ -325,7 +318,10 @@ class Schemas extends EventEmitter {
     if (!schema) {
       throw new SchemaError('MISSING_SCHEMA', `Schema '${schemaName}' not found`, { schemaName })
     }
-    return schema.build(options)
+    if (options.useCache !== false) return schema.build(options)
+    // build into a fresh instance so per-call options (e.g. extensionFilter) don't mutate the registry
+    const isolated = this.createSchema(schema.filePath, { enableCache: false })
+    return isolated.build(options)
   }
 
   /**
@@ -367,7 +363,7 @@ class Schemas extends EventEmitter {
     return Object.entries(this.schemas).reduce((info, [name, schema]) => {
       info[name] = {
         filePath: schema.filePath,
-        extensions: schema.extensions,
+        extensions: this.schemaExtensions[name] ?? [],
         hasParent: !!schema.raw?.$merge?.source?.$ref,
         isPatch: !!schema.raw?.$patch
       }

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/cgkineo/adapt-schemas"
   },
-  "version": "3.1.1",
+  "version": "3.1.2",
   "description": "Standalone JSON Schema library for the Adapt framework",
   "type": "module",
   "main": "index.js",

package/test.js

@@ -1,7 +1,7 @@
 /**
  * Test script for the Adapt Schema Library
  */
-import Schemas from './index.js'
+import Schemas, { XSSDefaults } from './index.js'
 import path from 'path'
 import { fileURLToPath } from 'url'
 import fs from 'fs/promises'
@@ -222,6 +222,35 @@ async function setupTestSchemas () {
     JSON.stringify(languagePickerConfigSchema, null, 2)
   )
 
+  // Schema used for XSS sanitization tests — string fields at top level
+  // and nested inside an object so sanitise() recursion is exercised.
+  const xssTestSchema = {
+    $schema: 'https://json-schema.org/draft/2020-12/schema',
+    $anchor: 'xss-test',
+    $merge: {
+      source: { $ref: 'base' },
+      with: {
+        properties: {
+          body: { type: 'string', default: '' },
+          title: { type: 'string', default: '' },
+          count: { type: 'number', default: 0 },
+          meta: {
+            type: 'object',
+            properties: {
+              description: { type: 'string', default: '' },
+              author: { type: 'string', default: '' }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  await fs.writeFile(
+    path.join(testSchemaDir, 'xss-test.schema.json'),
+    JSON.stringify(xssTestSchema, null, 2)
+  )
+
   // Create a patch schema that extends course
   const coursePatchSchema = {
     $schema: 'https://json-schema.org/draft/2020-12/schema',
@@ -574,6 +603,311 @@ async function runTests () {
     }
     console.log('')
 
+    // Test 19: XSS sanitization — dangerous content is stripped or escaped
+    console.log('Test 19: XSS sanitization — dangerous payloads')
+    const xssSchema = await library.getSchema('xss-test')
+    const sanitiseBody = input => xssSchema.sanitise({ body: input }, { sanitiseHtml: true, strict: false }).body
+
+    const dangerousCases = [
+      {
+        desc: '<script> tag escaped',
+        input: '<script>alert(1)</script>',
+        check: out => !/<script/i.test(out) && !out.includes('alert(1)</script>')
+      },
+      {
+        desc: 'onerror handler stripped from <img>',
+        input: '<img src=x onerror="alert(1)">',
+        check: out => !/onerror/i.test(out)
+      },
+      {
+        desc: 'onclick handler stripped from allowed <a>',
+        input: '<a href="https://example.com" onclick="evil()">link</a>',
+        check: out => !/onclick/i.test(out) && out.includes('example.com')
+      },
+      {
+        desc: 'javascript: URL stripped from <a href>',
+        input: '<a href="javascript:alert(1)">click</a>',
+        check: out => !/javascript:/i.test(out)
+      },
+      {
+        desc: '<iframe> (not whitelisted) escaped',
+        input: '<iframe src="https://evil.com"></iframe>',
+        check: out => !/<iframe/i.test(out)
+      },
+      {
+        desc: '<svg onload> (not whitelisted) escaped',
+        input: '<svg onload="alert(1)"></svg>',
+        check: out => !/<svg/i.test(out)
+      },
+      {
+        desc: '<object> (not whitelisted) escaped',
+        input: '<object data="evil.swf"></object>',
+        check: out => !/<object/i.test(out)
+      },
+      {
+        desc: 'style attribute (not whitelisted) stripped from <div>',
+        input: '<div style="background:url(javascript:alert(1))">x</div>',
+        check: out => !/style=/i.test(out) && !/javascript:/i.test(out)
+      },
+      {
+        desc: 'data: URI in href stripped',
+        input: '<a href="data:text/html,<script>alert(1)</script>">x</a>',
+        check: out => !/data:text\/html/i.test(out) && !/<script/i.test(out)
+      }
+    ]
+
+    const dangerousResults = dangerousCases.map(({ desc, input, check }) => {
+      const out = sanitiseBody(input)
+      const ok = check(out)
+      return { desc, input, out, ok }
+    })
+    dangerousResults.forEach(({ desc, input, out, ok }) => {
+      console.log(`  ${ok ? '✓' : '✗'} ${desc}`)
+      if (!ok) console.log(`    input:  ${JSON.stringify(input)}\n    output: ${JSON.stringify(out)}`)
+    })
+    const dangerousFailed = dangerousResults.filter(r => !r.ok)
+    if (dangerousFailed.length) {
+      throw new Error(`Dangerous-payload failures: ${dangerousFailed.map(r => r.desc).join(', ')}`)
+    }
+    console.log('')
+
+    // Test 20: XSS sanitization — safe content passes through
+    console.log('Test 20: XSS sanitization — safe content preserved')
+    const safeCases = [
+      { desc: 'plain text unchanged', input: 'Hello, world.', check: out => out === 'Hello, world.' },
+      { desc: 'empty string unchanged', input: '', check: out => out === '' },
+      { desc: '<b> preserved', input: '<b>bold</b>', check: out => /<b>bold<\/b>/.test(out) },
+      { desc: '<strong> preserved', input: '<strong>x</strong>', check: out => /<strong>x<\/strong>/.test(out) },
+      { desc: '<em> preserved', input: '<em>x</em>', check: out => /<em>x<\/em>/.test(out) },
+      {
+        desc: '<a href=https://> preserved with href',
+        input: '<a href="https://example.com">link</a>',
+        check: out => /<a[^>]+href="https:\/\/example\.com"[^>]*>link<\/a>/.test(out)
+      },
+      {
+        desc: '<a href=http://> (http) preserved',
+        input: '<a href="http://example.com">link</a>',
+        check: out => /href="http:\/\/example\.com"/.test(out)
+      },
+      {
+        desc: 'nested allowed tags preserved',
+        input: '<p><strong>bold</strong> and <em>italic</em></p>',
+        check: out => /<strong>bold<\/strong>/.test(out) && /<em>italic<\/em>/.test(out)
+      },
+      {
+        desc: 'text with ampersand entities preserved',
+        input: 'Fish &amp; chips',
+        check: out => out.includes('&amp;') || out.includes('&')
+      }
+    ]
+
+    const safeResults = safeCases.map(({ desc, input, check }) => {
+      const out = sanitiseBody(input)
+      return { desc, input, out, ok: check(out) }
+    })
+    safeResults.forEach(({ desc, input, out, ok }) => {
+      console.log(`  ${ok ? '✓' : '✗'} ${desc}`)
+      if (!ok) console.log(`    input:  ${JSON.stringify(input)}\n    output: ${JSON.stringify(out)}`)
+    })
+    const safeFailed = safeResults.filter(r => !r.ok)
+    if (safeFailed.length) {
+      throw new Error(`Safe-content failures: ${safeFailed.map(r => r.desc).join(', ')}`)
+    }
+    console.log('')
+
+    // Test 21: XSS sanitization — nested objects and non-string fields
+    console.log('Test 21: XSS sanitization — recursion + type handling')
+    const nestedInput = {
+      body: '<script>alert("top")</script><b>safe</b>',
+      title: '<img src=x onerror=alert(1)>',
+      count: 42,
+      meta: {
+        description: '<iframe src="evil"></iframe>clean',
+        author: '<a href="javascript:bad()">me</a>'
+      }
+    }
+    const nestedOut = xssSchema.sanitise(nestedInput, { sanitiseHtml: true, strict: false })
+    const nestedChecks = [
+      ['top-level string sanitized (script removed)', !/<script/i.test(nestedOut.body)],
+      ['top-level string sanitized (b preserved)', /<b>safe<\/b>/.test(nestedOut.body)],
+      ['top-level string sanitized (onerror removed)', !/onerror/i.test(nestedOut.title)],
+      ['number field passed through untouched', nestedOut.count === 42],
+      ['nested string sanitized (iframe escaped)', !/<iframe/i.test(nestedOut.meta.description)],
+      ['nested string sanitized (javascript: stripped)', !/javascript:/i.test(nestedOut.meta.author)]
+    ]
+    nestedChecks.forEach(([desc, ok]) => console.log(`  ${ok ? '✓' : '✗'} ${desc}: ${ok}`))
+    const nestedFailed = nestedChecks.filter(([, ok]) => !ok)
+    if (nestedFailed.length) {
+      throw new Error(`Nested sanitization failures: ${nestedFailed.map(([d]) => d).join(', ')}`)
+    }
+    console.log('')
+
+    // Test 22: xssWhitelistOverride replaces defaults at construction
+    console.log('Test 22: xssWhitelistOverride replaces defaults at construction')
+    const restrictiveLibrary = new Schemas({
+      enableCache: false,
+      xssWhitelistOverride: true,
+      xssWhitelist: { strong: [] } // only <strong> allowed, no attributes
+    })
+    restrictiveLibrary.init()
+    await restrictiveLibrary.loadSchemas('xss-test.schema.json', { cwd: testSchemaDir })
+    const restrictiveSchema = await restrictiveLibrary.getSchema('xss-test')
+    const restrictiveSanitise = input =>
+      restrictiveSchema.sanitise({ body: input }, { sanitiseHtml: true, strict: false }).body
+
+    const overrideChecks = [
+      ['<strong> (in custom list) preserved', /<strong>x<\/strong>/.test(restrictiveSanitise('<strong>x</strong>'))],
+      ['<b> (in defaults, not custom) escaped', !/<b>x<\/b>/.test(restrictiveSanitise('<b>x</b>'))],
+      ['<a> (in defaults, not custom) escaped', !/<a /i.test(restrictiveSanitise('<a href="https://example.com">x</a>'))],
+      ['<script> still escaped', !/<script/i.test(restrictiveSanitise('<script>alert(1)</script>'))]
+    ]
+    overrideChecks.forEach(([desc, ok]) => console.log(`  ${ok ? '✓' : '✗'} ${desc}: ${ok}`))
+    const overrideFailed = overrideChecks.filter(([, ok]) => !ok)
+    if (overrideFailed.length) {
+      throw new Error(`xssWhitelistOverride failures: ${overrideFailed.map(([d]) => d).join(', ')}`)
+    }
+    console.log('')
+
+    // Test 23: Exhaustive round-trip of XSSDefaults — every allowed tag and
+    // every allowed attribute on that tag survives; a disallowed attribute
+    // (onclick, not in any default list) is stripped from every tag.
+    console.log('Test 23: Exhaustive XSSDefaults coverage')
+    const voidTags = new Set(['area', 'br', 'col', 'hr', 'img', 'wbr'])
+    const urlAttrs = new Set(['href', 'src', 'cite', 'poster'])
+    const numericAttrs = new Set([
+      'colspan', 'coords', 'height', 'rowspan', 'size', 'span', 'tabindex', 'width'
+    ])
+    const booleanAttrs = new Set([
+      'autoplay', 'controls', 'loop', 'muted', 'open', 'playsinline', 'preload'
+    ])
+
+    const safeAttrValue = attr => {
+      if (urlAttrs.has(attr)) return 'https://example.com/x'
+      if (numericAttrs.has(attr)) return '1'
+      if (booleanAttrs.has(attr)) return attr
+      if (attr === 'datetime') return '2024-01-01T00:00:00Z'
+      if (attr === 'dir') return 'ltr'
+      if (attr === 'align' || attr === 'valign') return 'left'
+      if (attr === 'shape') return 'rect'
+      if (attr === 'lang') return 'en'
+      if (attr === 'role') return 'button'
+      if (attr === 'color') return 'red'
+      return 'test'
+    }
+
+    const openTag = (tag, attrs) => {
+      const attrStr = attrs ? ` ${attrs}` : ''
+      return voidTags.has(tag) ? `<${tag}${attrStr}>` : `<${tag}${attrStr}>x</${tag}>`
+    }
+
+    const exhaustiveLibrary = new Schemas({ enableCache: false })
+    exhaustiveLibrary.init()
+    await exhaustiveLibrary.loadSchemas('xss-test.schema.json', { cwd: testSchemaDir })
+    const exhaustiveSchema = await exhaustiveLibrary.getSchema('xss-test')
+    const san = input => exhaustiveSchema.sanitise({ body: input }, { sanitiseHtml: true, strict: false }).body
+
+    const tagFailures = []
+    const attrFailures = []
+    const disallowedFailures = []
+    let tagCount = 0
+    let attrCount = 0
+
+    Object.entries(XSSDefaults).forEach(([tag, attrs]) => {
+      tagCount++
+
+      const tagOut = san(openTag(tag))
+      if (!tagOut.includes(`<${tag}`)) {
+        tagFailures.push({ tag, output: tagOut })
+      }
+
+      const badInput = openTag(tag, 'onclick="evil()"')
+      const badOut = san(badInput)
+      if (/onclick/i.test(badOut)) {
+        disallowedFailures.push({ tag, output: badOut })
+      }
+
+      attrs.forEach(attr => {
+        attrCount++
+        const val = safeAttrValue(attr)
+        const out = san(openTag(tag, `${attr}="${val}"`))
+        if (!out.toLowerCase().includes(`${attr.toLowerCase()}=`)) {
+          attrFailures.push({ tag, attr, val, output: out })
+        }
+      })
+    })
+
+    console.log(`  ${tagFailures.length === 0 ? '✓' : '✗'} ${tagCount} tags preserved (${tagFailures.length} failures)`)
+    tagFailures.forEach(({ tag, output }) => console.log(`    - <${tag}> → ${JSON.stringify(output)}`))
+    console.log(`  ${attrFailures.length === 0 ? '✓' : '✗'} ${attrCount} (tag, attr) pairs preserved (${attrFailures.length} failures)`)
+    attrFailures.forEach(({ tag, attr, val, output }) =>
+      console.log(`    - <${tag} ${attr}="${val}"> → ${JSON.stringify(output)}`)
+    )
+    console.log(`  ${disallowedFailures.length === 0 ? '✓' : '✗'} ${tagCount} onclick-strip checks (${disallowedFailures.length} failures)`)
+    disallowedFailures.forEach(({ tag, output }) => console.log(`    - <${tag} onclick> → ${JSON.stringify(output)}`))
+
+    const totalExhaustiveFailures = tagFailures.length + attrFailures.length + disallowedFailures.length
+    if (totalExhaustiveFailures > 0) {
+      throw new Error(`XSSDefaults exhaustive check: ${totalExhaustiveFailures} total failures`)
+    }
+    console.log('')
+
+    // Test 24: deregisterSchema cleans up extension references (issue #37)
+    console.log('Test 24: deregisterSchema cleans up extension references (issue #37)')
+    const extPatchPath = path.join(testSchemaDir, 'patch-ext.schema.json')
+    await fs.writeFile(extPatchPath, JSON.stringify({
+      $schema: 'https://json-schema.org/draft/2020-12/schema',
+      $anchor: 'patch-ext',
+      type: 'object',
+      $patch: { source: { $ref: 'config' }, with: { properties: { _patchAdded: { type: 'string', default: 'added' } } } }
+    }, null, 2))
+    library.registerSchema(extPatchPath)
+    const beforeDeregister = library.schemaExtensions.config?.includes('patch-ext')
+    console.log(`  ✓ Extension registered against base: ${beforeDeregister}`)
+    const builtWithExt = (await library.getSchema('config')).built
+    const hasPatchedProperty = '_patchAdded' in (builtWithExt.properties ?? {})
+    console.log(`  ✓ Patched property visible in cached build: ${hasPatchedProperty}`)
+    library.deregisterSchema('patch-ext')
+    const afterDeregister = !library.schemaExtensions.config?.includes('patch-ext')
+    console.log(`  ✓ Extension removed from base after deregister: ${afterDeregister}`)
+    const cacheInvalidated = library.schemas.config?.built === undefined
+    console.log(`  ✓ Base cached build invalidated on deregister: ${cacheInvalidated}`)
+    let buildSucceeded = true
+    let postRebuildHasPatch = true
+    try {
+      const rebuilt = (await library.getSchema('config')).built
+      postRebuildHasPatch = '_patchAdded' in (rebuilt.properties ?? {})
+    } catch (e) {
+      buildSucceeded = false
+    }
+    console.log(`  ✓ Cached rebuild of base after deregister succeeds: ${buildSucceeded}`)
+    console.log(`  ✓ Patched property gone from rebuilt schema: ${!postRebuildHasPatch}`)
+    if (!beforeDeregister || !hasPatchedProperty || !afterDeregister || !cacheInvalidated || !buildSucceeded || postRebuildHasPatch) {
+      throw new Error('deregisterSchema did not clean up extension references and cached builds correctly')
+    }
+    console.log('')
+
+    // Test 25: useCache:false isolates filtered builds from the registry instance
+    console.log('Test 25: useCache:false isolates filtered builds from the registry instance')
+    const includeLP = s => s === 'languagePicker-config'
+    const excludeLP = () => false
+    const registrySchema = library.schemas.config
+    const withLPSchema = await library.getSchema('config', { useCache: false, extensionFilter: includeLP })
+    const withoutLPSchema = await library.getSchema('config', { useCache: false, extensionFilter: excludeLP })
+    const withLPHas = '_languagePicker' in (withLPSchema.built.properties ?? {})
+    const withoutLPHas = '_languagePicker' in (withoutLPSchema.built.properties ?? {})
+    console.log(`  ✓ Filter-include build has _languagePicker: ${withLPHas}`)
+    console.log(`  ✓ Filter-exclude build lacks _languagePicker: ${!withoutLPHas}`)
+    // earlier build's properties must not be mutated by the later build (the original race)
+    const withLPStillHas = '_languagePicker' in (withLPSchema.built.properties ?? {})
+    console.log(`  ✓ Earlier filter-include build is unaffected by later call: ${withLPStillHas}`)
+    // each filtered call must return a fresh instance, not the registry one
+    const isolatedFromRegistry = withLPSchema !== registrySchema && withoutLPSchema !== registrySchema && withLPSchema !== withoutLPSchema
+    console.log(`  ✓ Filtered builds return isolated Schema instances: ${isolatedFromRegistry}`)
+    if (!withLPHas || withoutLPHas || !withLPStillHas || !isolatedFromRegistry) {
+      throw new Error('useCache:false did not isolate filtered builds from the registry')
+    }
+    console.log('')
+
     console.log('=== All tests passed! ===')
   } finally {
     if (!hasSpecifiedPath) {