ata-validator 0.7.3 → 0.8.0

package/CMakeLists.txt

@@ -19,43 +19,48 @@ endif()
 option(ATA_TESTING "Build test suite" ON)
 option(ATA_BENCHMARKS "Build benchmarks" OFF)
 option(ATA_SANITIZE "Enable address sanitizer" OFF)
+option(ATA_NO_RE2 "Build without RE2 regex engine (disables pattern keyword)" OFF)
 
 # Fetch simdjson
 include(FetchContent)
 FetchContent_Declare(
   simdjson
   GIT_REPOSITORY https://github.com/simdjson/simdjson.git
-  GIT_TAG v3.12.2
+  GIT_TAG v4.5.0
   GIT_SHALLOW TRUE
 )
 
-# RE2 — fast regex engine (replaces std::regex)
-set(RE2_BUILD_TESTING OFF CACHE BOOL "" FORCE)
-FetchContent_Declare(
-  re2
-  GIT_REPOSITORY https://github.com/google/re2.git
-  GIT_TAG 2024-07-02
-  GIT_SHALLOW TRUE
-  EXCLUDE_FROM_ALL
-)
+if(NOT ATA_NO_RE2)
+  # RE2 — fast regex engine (replaces std::regex)
+  set(RE2_BUILD_TESTING OFF CACHE BOOL "" FORCE)
+  FetchContent_Declare(
+    re2
+    GIT_REPOSITORY https://github.com/google/re2.git
+    GIT_TAG 2024-07-02
+    GIT_SHALLOW TRUE
+    EXCLUDE_FROM_ALL
+  )
 
-# Abseil — required by RE2
-set(ABSL_PROPAGATE_CXX_STD ON CACHE BOOL "" FORCE)
-set(ABSL_BUILD_TESTING OFF CACHE BOOL "" FORCE)
-set(ABSL_ENABLE_INSTALL ON CACHE BOOL "" FORCE)
-FetchContent_Declare(
-  abseil-cpp
-  GIT_REPOSITORY https://github.com/abseil/abseil-cpp.git
-  GIT_TAG 20240722.0
-  GIT_SHALLOW TRUE
-)
+  # Abseil — required by RE2
+  set(ABSL_PROPAGATE_CXX_STD ON CACHE BOOL "" FORCE)
+  set(ABSL_BUILD_TESTING OFF CACHE BOOL "" FORCE)
+  set(ABSL_ENABLE_INSTALL ON CACHE BOOL "" FORCE)
+  FetchContent_Declare(
+    abseil-cpp
+    GIT_REPOSITORY https://github.com/abseil/abseil-cpp.git
+    GIT_TAG 20240722.0
+    GIT_SHALLOW TRUE
+  )
 
-FetchContent_MakeAvailable(abseil-cpp simdjson re2)
+  FetchContent_MakeAvailable(abseil-cpp simdjson re2)
+else()
+  FetchContent_MakeAvailable(simdjson)
+endif()
 
 if (CMAKE_JS_VERSION)
   # add_definitions(-DNAPI_VERSION=10)
   include_directories(${CMAKE_JS_INC})
-  file(GLOB SOURCE_FILES "binding/*.cpp" "src/*.cpp" "deps/simdjson/*.cpp")
+  file(GLOB SOURCE_FILES "binding/*.cpp" "src/*.cpp")
 else()
   file(GLOB SOURCE_FILES "src/*.cpp")
 endif()
@@ -88,7 +93,12 @@ else()
 endif()
 
 target_include_directories(${PROJECT_NAME} PUBLIC include)
-target_link_libraries(${PROJECT_NAME} PRIVATE simdjson re2)
+if(ATA_NO_RE2)
+  target_link_libraries(${PROJECT_NAME} PRIVATE simdjson)
+  target_compile_definitions(${PROJECT_NAME} PRIVATE ATA_NO_RE2)
+else()
+  target_link_libraries(${PROJECT_NAME} PRIVATE simdjson re2)
+endif()
 
 if (CMAKE_JS_VERSION)
   target_include_directories(${PROJECT_NAME} PRIVATE ${CMAKE_JS_INC})
@@ -130,3 +140,11 @@ if(ATA_BENCHMARKS)
   add_executable(ata_bench benchmark/bench.cpp)
   target_link_libraries(ata_bench PRIVATE ata simdjson)
 endif()
+
+# Fuzz targets (for OSS-Fuzz / libFuzzer)
+if(ATA_FUZZING)
+  foreach(fuzzer compile_fuzzer validate_fuzzer roundtrip_fuzzer)
+    add_executable(${fuzzer} fuzz/${fuzzer}.cpp)
+    target_link_libraries(${fuzzer} PRIVATE ata simdjson ${LIB_FUZZING_ENGINE})
+  endforeach()
+endif()

package/README.md

@@ -106,8 +106,8 @@ Three-tier hybrid codegen: static schemas compile to zero-overhead key checks, d
 
 ## When to use ajv
 
-- **100% spec compliance needed** - ajv covers more edge cases (ata: 96.9%)
 - **`$dynamicRef`** - not yet supported in ata
+- **Existing ajv ecosystem** - plugins, custom keywords, large community
 
 ## Features
 

package/binding/ata_napi.cpp

@@ -9,7 +9,9 @@
 #include <functional>
 #include <queue>
 #include <atomic>
+#ifndef ATA_NO_RE2
 #include <re2/re2.h>
+#endif
 #include <set>
 #include <string>
 #include <vector>
@@ -39,7 +41,9 @@ struct schema_node {
   std::optional<uint64_t> min_length;
   std::optional<uint64_t> max_length;
   std::optional<std::string> pattern;
+#ifndef ATA_NO_RE2
   std::shared_ptr<re2::RE2> compiled_pattern;
+#endif
 
   std::optional<uint64_t> min_items;
   std::optional<uint64_t> max_items;
@@ -63,7 +67,9 @@ struct schema_node {
   struct pattern_prop {
     std::string pattern;
     schema_node_ptr schema;
+#ifndef ATA_NO_RE2
     std::shared_ptr<re2::RE2> compiled;
+#endif
   };
   std::vector<pattern_prop> pattern_properties;
 
@@ -83,6 +89,8 @@ struct schema_node {
   schema_node_ptr else_schema;
 
   std::string ref;
+  std::string dynamic_ref;
+  std::string id;
 
   std::unordered_map<std::string, schema_node_ptr> defs;
 
@@ -114,10 +122,14 @@ static bool napi_check_format(const std::string& sv, const std::string& fmt) {
            (sv.size() - dot - 1) >= 2;
   }
   if (fmt == "date") {
-    return sv.size() == 10 && nb_is_digit(sv[0]) && nb_is_digit(sv[1]) &&
-           nb_is_digit(sv[2]) && nb_is_digit(sv[3]) && sv[4] == '-' &&
-           nb_is_digit(sv[5]) && nb_is_digit(sv[6]) && sv[7] == '-' &&
-           nb_is_digit(sv[8]) && nb_is_digit(sv[9]);
+    if (sv.size() != 10 || !nb_is_digit(sv[0]) || !nb_is_digit(sv[1]) ||
+        !nb_is_digit(sv[2]) || !nb_is_digit(sv[3]) || sv[4] != '-' ||
+        !nb_is_digit(sv[5]) || !nb_is_digit(sv[6]) || sv[7] != '-' ||
+        !nb_is_digit(sv[8]) || !nb_is_digit(sv[9]))
+      return false;
+    int month = (sv[5] - '0') * 10 + (sv[6] - '0');
+    int day = (sv[8] - '0') * 10 + (sv[9] - '0');
+    return month >= 1 && month <= 12 && day >= 1 && day <= 31;
   }
   if (fmt == "time") {
     if (sv.size() < 8) return false;
@@ -286,6 +298,15 @@ static void validate_napi(const schema_node_ptr& node,
                            const compiled_schema_internal& ctx,
                            std::vector<ata::validation_error>& errors);
 
+// Recursion depth guard — prevents stack overflow on self-referencing schemas
+struct NapiDepthGuard {
+  static thread_local int depth;
+  bool overflow;
+  NapiDepthGuard() : overflow(++depth > 100) {}
+  ~NapiDepthGuard() { --depth; }
+};
+thread_local int NapiDepthGuard::depth = 0;
+
 static void validate_napi(const schema_node_ptr& node,
                            Napi::Value value,
                            Napi::Env env,
@@ -294,6 +315,9 @@ static void validate_napi(const schema_node_ptr& node,
                            std::vector<ata::validation_error>& errors) {
   if (!node) return;
 
+  NapiDepthGuard guard;
+  if (guard.overflow) return;
+
   // Boolean schema
   if (node->boolean_schema.has_value()) {
     if (!node->boolean_schema.value()) {
@@ -516,6 +540,7 @@ static void validate_napi(const schema_node_ptr& node,
                             " > maxLength " +
                             std::to_string(node->max_length.value())});
     }
+#ifndef ATA_NO_RE2
     if (node->compiled_pattern) {
       if (!re2::RE2::PartialMatch(sv, *node->compiled_pattern)) {
         errors.push_back({ata::error_code::pattern_mismatch, path,
@@ -523,6 +548,7 @@ static void validate_napi(const schema_node_ptr& node,
                               node->pattern.value()});
       }
     }
+#endif
     if (node->format.has_value()) {
       const auto& fmt = node->format.value();
       bool format_ok = napi_check_format(sv, fmt);
@@ -644,11 +670,13 @@ static void validate_napi(const schema_node_ptr& node,
       }
 
       for (const auto& pp : node->pattern_properties) {
+#ifndef ATA_NO_RE2
         if (pp.compiled && re2::RE2::PartialMatch(key_str, *pp.compiled)) {
           validate_napi(pp.schema, val, env, path + "/" + key_str, ctx,
                         errors);
           matched = true;
         }
+#endif
       }
 
       if (!matched) {

package/index.js

@@ -309,6 +309,14 @@ function buildSchemaMap(schemas) {
   return map
 }
 
+// Resolve a relative URI ref against a base URI
+function resolveRelativeRef(ref, baseId) {
+  if (!baseId || ref.includes('://') || ref.startsWith('#')) return ref
+  const lastSlash = baseId.lastIndexOf('/')
+  if (lastSlash < 0) return ref
+  return baseId.substring(0, lastSlash + 1) + ref
+}
+
 class Validator {
   constructor(schema, opts) {
     const options = opts || {};
@@ -405,17 +413,20 @@ class Validator {
       ? this._schemaStr + '\0' + [...this._schemaMap.keys()].sort().join('\0')
       : this._schemaStr;
     const cached = _compileCache.get(mapKey);
-    let jsFn, jsCombinedFn, jsErrFn;
+    let jsFn, jsCombinedFn, jsErrFn, _isCodegen = false;
     var _forceNapi = typeof process !== 'undefined' && process.env && process.env.ATA_FORCE_NAPI;
     if (cached && !_forceNapi) {
       jsFn = cached.jsFn;
       jsCombinedFn = cached.combined;
       jsErrFn = cached.errFn;
+      _isCodegen = !!cached.isCodegen;
     } else if (!_forceNapi) {
-      jsFn = compileToJSCodegen(schemaObj, sm) || compileToJS(schemaObj, null, sm);
+      const _cgFn = compileToJSCodegen(schemaObj, sm);
+      jsFn = _cgFn || compileToJS(schemaObj, null, sm);
       jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm);
       jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm);
-      _compileCache.set(mapKey, { jsFn, combined: jsCombinedFn, errFn: jsErrFn });
+      _isCodegen = !!_cgFn;
+      _compileCache.set(mapKey, { jsFn, combined: jsCombinedFn, errFn: jsErrFn, isCodegen: _isCodegen });
     } else {
       jsFn = null; jsCombinedFn = null; jsErrFn = null;
     }
@@ -465,14 +476,20 @@ class Validator {
       // errFn: use JS codegen if safe, else lazy-native fallback
       // For unevaluated schemas without errFn, use jsFn as boolean-only fallback
       const hasUnevaluated = schemaObj && JSON.stringify(schemaObj).includes('unevaluatedProperties') || JSON.stringify(schemaObj).includes('unevaluatedItems')
+      const hasDynRef = this._schemaStr.includes('"$dynamicRef"') || this._schemaStr.includes('"$dynamicAnchor"')
       const errFn =
         safeErrFn ||
         (hasUnevaluated
           ? (d) => ({ valid: jsFn(d), errors: jsFn(d) ? [] : [{ code: 'unevaluated', path: '', message: 'unevaluated property or item' }] })
-          : (d) => {
-              this._ensureNative();
-              return this._compiled.validate(d);
-            });
+          : hasDynRef
+            ? (d) => {
+                this._ensureNative();
+                return this._compiled.validateJSON(JSON.stringify(d));
+              }
+            : (d) => {
+                this._ensureNative();
+                return this._compiled.validate(d);
+              });
 
       // Best path: combined validator (single pass, validates + collects errors)
       // Valid data: returns VALID_RESULT, no allocation
@@ -501,23 +518,30 @@ class Validator {
         } catch {}
       }
 
-      if (safeCombinedFn && jsFn) {
-        // Hybrid: jsFn boolean guard for valid (fast, no allocation), combined for invalid
+      if (hasDynRef && _isCodegen && jsFn) {
+        // $dynamicRef with JS codegen: direct path, no wrapper layers
+        const _fn = jsFn, _efn = safeErrFn || errFn, _R = VALID_RESULT;
         this.validate = preprocess
-          ? (data) => {
-              preprocess(data);
-              return jsFn(data) ? VALID_RESULT : safeCombinedFn(data);
-            }
-          : (data) => jsFn(data) ? VALID_RESULT : safeCombinedFn(data);
+          ? (data) => { preprocess(data); return _fn(data) ? _R : _efn(data); }
+          : (data) => _fn(data) ? _R : _efn(data);
+      } else if (hasDynRef) {
+        // $dynamicRef without codegen: delegate to native C++ (interpretive path unreliable)
+        this.validate = preprocess
+          ? (data) => { preprocess(data); return errFn(data); }
+          : errFn;
+      } else if (jsFn && jsFn._hybridFactory) {
+        // Zero-wrapper: hybridFactory bakes VALID_RESULT + errFn into a single function
+        // No arrow function wrapper, no ternary, one function call
+        const hybridFn = jsFn._hybridFactory(VALID_RESULT, safeCombinedFn || errFn);
+        this.validate = preprocess
+          ? (data) => { preprocess(data); return hybridFn(data); }
+          : hybridFn;
       } else if (safeCombinedFn) {
         this.validate = preprocess
-          ? (data) => {
-              preprocess(data);
-              return safeCombinedFn(data);
-            }
+          ? (data) => { preprocess(data); return safeCombinedFn(data); }
           : safeCombinedFn;
       } else {
-        const hybridFn = jsFn._hybridFactory
+        const hybridFn = jsFn && jsFn._hybridFactory
           ? jsFn._hybridFactory(VALID_RESULT, errFn)
           : null;
         this.validate = hybridFn
@@ -616,15 +640,21 @@ class Validator {
         };
       }
     } else if (native) {
-      // ATA_FORCE_NAPI path: no JS codegen, use native for everything
+      // Native-only path: no JS codegen, use native for everything
       this._ensureNative();
+      const _hasDynamic = this._schemaStr.includes('"$dynamicRef"') || this._schemaStr.includes('"$dynamicAnchor"') || this._schemaStr.includes('"$anchor"')
+      // For schemas with dynamic refs/anchors, use validateJSON (C++ path with full support)
+      // instead of validate (NAPI direct V8 path without anchor maps)
+      const _validate = _hasDynamic
+        ? (data) => this._compiled.validateJSON(JSON.stringify(data))
+        : (data) => this._compiled.validate(data);
       this.validate = preprocess
         ? (data) => {
             preprocess(data);
-            return this._compiled.validate(data);
+            return _validate(data);
           }
-        : (data) => this._compiled.validate(data);
-      this.isValidObject = (data) => this._compiled.validate(data).valid;
+        : _validate;
+      this.isValidObject = (data) => _validate(data).valid;
       this.validateJSON = (jsonStr) => this._compiled.validateJSON(jsonStr);
       this.isValidJSON = (jsonStr) => this._compiled.isValidJSON(jsonStr);
       {