ata-validator 1.63.1 → 1.63.2

package/bin/ata.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
 'use strict';
 const { env } = require('../lib/env');
+// Text that comes from a schema file (a $ref, a keyword name in a warning) is
+// written with its control characters as escapes, as `ata validate` writes
+// it: a schema could otherwise clear the screen or forge an `ata:` line.
+const term = (t) => require('../lib/diagnose').term(String(t));
 
 const fs = require('fs');
 const path = require('path');
@@ -299,7 +303,7 @@ function cmdCompile(args) {
       for (const w of compileWarnings) reportCompileError(input, w);
       process.exit(1);
     }
-    for (const w of compileWarnings) process.stderr.write(`ata: warning: ${input}: ${w}\n`);
+    for (const w of compileWarnings) process.stderr.write(`ata: warning: ${input}: ${term(w)}\n`);
   }
   if (!src) {
     reportCompileError(input, 'schema is too complex for standalone compilation');
@@ -397,7 +401,7 @@ function cmdBuild(args) {
     for (const c of report.compiled) {
       process.stdout.write(`ata: ${c.input} -> ${c.output} (${c.bytes.toLocaleString()} bytes${c.errors === 'compact' ? ', shared errors' : c.errors === 'schema' ? ', schema module' : ''})\n`);
       for (const t of (report.bunTargets || []).filter((t) => t.input === c.input)) process.stdout.write(`ata: bun target -> ${t.output} (for bun build --compile --aot)\n`);
-      for (const d of (report.bunDeclined || []).filter((d) => d.input === c.input)) process.stderr.write(`ata: warning: ${d.input}: ${d.reason}\n`);
+      for (const d of (report.bunDeclined || []).filter((d) => d.input === c.input)) process.stderr.write(`ata: warning: ${d.input}: ${term(d.reason)}\n`);
     }
     if (report.runtime) {
       process.stdout.write(`ata: error runtime -> ${report.runtime.output} (${report.runtime.bytes.toLocaleString()} bytes, shared by the modules above)\n`);
@@ -412,7 +416,7 @@ function cmdBuild(args) {
         noDetail++;
         process.stderr.write(`ata: warning ${w.input}: no error detail, failures report the single ATA9000 error (the verdict is exact)\n`);
       } else {
-        process.stderr.write(`ata: warning ${w.input}: ${w.warning}\n`);
+        process.stderr.write(`ata: warning ${w.input}: ${term(w.warning)}\n`);
       }
     }
     if (noDetail > 0 && args.opts.mode !== 'schema') {
@@ -422,7 +426,7 @@ function cmdBuild(args) {
       process.stdout.write(`ata: cached  ${c.input}\n`);
     }
     for (const s of report.skipped) {
-      process.stdout.write(`ata: skipped ${s.input}: ${s.reason}\n`);
+      process.stdout.write(`ata: skipped ${s.input}: ${term(s.reason)}\n`);
     }
     for (const f of report.failed) {
       reportCompileError(f.input, f.error);

package/lib/ir/emit.mjs

@@ -16,8 +16,16 @@ const FAST = {
   pattern: (n, x) => compilePatternInline(n, x),
   // A string has between length/2 and length code points, so the length
   // alone settles most cases and the count runs only near the bound.
-  minLength: (n, x) => `${x}.length>=${2 * n}||${x}.length>=${n}&&cpLen(${x})>=${n}`,
-  maxLength: (n, x) => `${x}.length<=${n}||${x}.length<=${2 * n}&&cpLen(${x})<=${n}`,
+  // The bound is written into the module as a number, so it has to be one: a
+  // schema that gave a string here had it written as source, and what the
+  // string said ran in whatever imported the module. Refused, as the closure
+  // writer refuses it.
+  minLength: (n, x) => { const b = bound(n, 'minLength'); return `${x}.length>=${2 * b}||${x}.length>=${b}&&cpLen(${x})>=${b}` },
+  maxLength: (n, x) => { const b = bound(n, 'maxLength'); return `${x}.length<=${b}||${x}.length<=${2 * b}&&cpLen(${x})<=${b}` },
+}
+function bound (n, k) {
+  if (typeof n !== 'number' || !Number.isFinite(n)) throw new Error(`ir: ${k} is not a number`)
+  return n
 }
 // enum and const with only primitive values need no deep equality: the
 // value is one of them exactly when it is === one of them (JSON numbers have

package/lib/js-compiler-errors.js

@@ -1147,11 +1147,16 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     const expected = types.join(', ')
     // As written: a one-element array stays an array, as the interpreted engine
     // reports it.
-    const expectedParam = !Array.isArray(schema.type) ? `'${types[0]}'` : JSON.stringify(types)
+    // Escaped like every other schema string written into this source: a
+    // type name is the schema author's text, and a quote in one that is not
+    // a JSON Schema type closed the literal and ran what followed as code,
+    // in the process that compiled the schema and in the module written
+    // from it.
+    const expectedParam = !Array.isArray(schema.type) ? `'${esc(String(types[0]))}'` : JSON.stringify(types)
     {
       const typeSp = `${schemaPrefix}/type`
       const lit = buildErrorLiteral({ keyword: 'type', schemaPath: typeSp, sourceMap: ctx.sourceMap })
-      lines.push(`if(!(${conds.join('||')})){_e.push({code:'${lit.codeStr}',keyword:'type',instancePath:${pathExpr||'""'},schemaPath:'${typeSp}'${ordinalField(ctx, `${typeSp}`)},params:{type:${expectedParam}},message:'must be ${expected}',docUrl:'${lit.docUrl}'${lit.frame}});if(!_all)return{valid:false,errors:_e}}`)
+      lines.push(`if(!(${conds.join('||')})){_e.push({code:'${lit.codeStr}',keyword:'type',instancePath:${pathExpr||'""'},schemaPath:'${typeSp}'${ordinalField(ctx, `${typeSp}`)},params:{type:${expectedParam}},message:'must be ${esc(expected)}',docUrl:'${lit.docUrl}'${lit.frame}});if(!_all)return{valid:false,errors:_e}}`)
     }
   }
 
@@ -2038,7 +2043,9 @@ TYPE_KEYWORDS.integer = TYPE_KEYWORDS.number
 const NOT_VALIDATING = new Set(['$schema', '$id', '$anchor', '$comment', '$defs', 'definitions', 'title', 'description', 'default', 'examples', 'deprecated', 'readOnly', 'writeOnly', '$vocabulary'])
 function typeMismatchRest(schema, types) {
   const drop = new Set(['type', 'enum', 'const', 'anyOf', 'oneOf'])
-  for (const t of types) for (const k of (TYPE_KEYWORDS[t] || [])) drop.add(k)
+  // Own names only: a type called `constructor` or `__proto__` read
+  // Object.prototype's member here and threw while compiling.
+  for (const t of types) if (Object.prototype.hasOwnProperty.call(TYPE_KEYWORDS, t)) for (const k of TYPE_KEYWORDS[t]) drop.add(k)
   // A built-in format is written for strings only (`typeof v==='string'&&`
   // off the string path), so for a value that failed `type: string` it can
   // never fire: carried here it was dead code in every module that checks one.
@@ -2435,11 +2442,16 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     const expected = types.join(', ')
     // As written: a one-element array stays an array, as the interpreted engine
     // reports it.
-    const expectedParam = !Array.isArray(schema.type) ? `'${types[0]}'` : JSON.stringify(types)
+    // Escaped like every other schema string written into this source: a
+    // type name is the schema author's text, and a quote in one that is not
+    // a JSON Schema type closed the literal and ran what followed as code,
+    // in the process that compiled the schema and in the module written
+    // from it.
+    const expectedParam = !Array.isArray(schema.type) ? `'${esc(String(types[0]))}'` : JSON.stringify(types)
     // Type check: push error but continue — wrap remaining in type-success block
     const typeOk = `_tok${ctx.varCounter++}`
     lines.push(`const ${typeOk}=${conds.join('||')}`)
-    lines.push(`if(!${typeOk}){${fail('type', 'type', `{type:${expectedParam}}`, `'must be ${expected}'`)}}`)
+    lines.push(`if(!${typeOk}){${fail('type', 'type', `{type:${expectedParam}}`, `'must be ${esc(expected)}'`)}}`)
     // Subsequent optimized code runs inside if(typeOk){...}
     if (types.length === 1) {
       isObj = types[0] === 'object'

package/lib/js-compiler.js

@@ -832,9 +832,9 @@ function resolveRef(ref, defs, schemaMap) {
 
 function buildTypeCheck(types) {
   if (types.length === 1) {
-    return TYPE_CHECKS[types[0]] || (() => true)
+    return typeCheckOf(types[0]) || (() => true)
   }
-  const fns = types.map(t => TYPE_CHECKS[t]).filter(Boolean)
+  const fns = types.map(typeCheckOf).filter(Boolean)
   return (d) => {
     for (let i = 0; i < fns.length; i++) {
       if (fns[i](d)) return true
@@ -902,6 +902,10 @@ function multipleOfBad(v, m) {
   return `!(Number.isInteger(${v}/${m})||Math.abs(${v}/${m}-Math.round(${v}/${m}))<1e-9)`
 }
 
+// Own names only: a type called `__proto__` or `valueOf` read
+// Object.prototype's member and was handed out as the check, and the
+// Validator then threw on the first document (`_fast is not a function`).
+const typeCheckOf = (t) => (Object.prototype.hasOwnProperty.call(TYPE_CHECKS, t) ? TYPE_CHECKS[t] : undefined)
 const TYPE_CHECKS = {
   string: (d) => typeof d === 'string',
   number: (d) => Number.isFinite(d),
@@ -4198,7 +4202,11 @@ function genDynamicRefNode(schema, v, lines, ctx, knownType) {
 function genUniqueItemsNode(schema, v, lines, ctx, knownType, hoisted, isArr, types) {
   const si = ctx.varCounter++
   const itemType = schema.items && typeof schema.items === 'object' && schema.items.type
-  const isPrimItems = itemType === 'string' || itemType === 'number' || itemType === 'integer'
+  // `items` speaks for the elements after the tuple only: with `prefixItems`
+  // the first positions may hold objects, and comparing those by identity
+  // took two equal objects for different ones and accepted the array.
+  const noTuple = !Array.isArray(schema.prefixItems) || schema.prefixItems.length === 0
+  const isPrimItems = noTuple && (itemType === 'string' || itemType === 'number' || itemType === 'integer')
   const maxItems = schema.maxItems
   // Small primitive arrays (maxItems <= 16): nested loop is 6x faster than Set
   // No allocation, no hash computation — just direct === comparison

package/lib/regex-linear.js

@@ -36,6 +36,15 @@ const { parse } = require('./safe-regex')
 // holds them: every accepted pattern answers as the linear engine does and
 // stays fast on inputs built to make a backtracking engine retry.
 const NATIVE_ESCAPES = new Set(['d', 'D', 'w', 'W', 's', 'S', 'n', 'r', 't', 'f', 'v', '.', '\\', '/', '^', '$', '|', '?', '*', '+', '(', ')', '[', ']', '{', '}', '-', 'x', 'u'])
+// How many ways a backtracking engine can split one string over the bounded
+// choices of a pattern. Choices in a row multiply: `(a?){30}` is thirty
+// choices and two to the thirtieth ways, which the engine walks through on a
+// string that does not match. The count used to be a sum capped at 64, so
+// that pattern and `^([a-z]?){64}$` passed as linear and a string of 17
+// characters ran for more than half a minute. Now the product, capped where
+// the worst case stays under a millisecond for a hundred characters.
+const MAX_WAYS = 4096
+// The sum of bounded choices, which both rules below also hold to.
 const MAX_BOUNDED_CHOICES = 64
 
 const atom = (n) => n.t === 'char' || n.t === 'class' || n.t === 'any'
@@ -52,7 +61,9 @@ function anchored (ast) {
 function simpleRule (ast) {
   // Per subtree: how many unbounded quantifiers it holds (`u`) and how many
   // bounded choices a backtracking engine could try (`b`), or null where the
-  // shape is not provably linear.
+  // shape is not provably linear. The choices are held to a sum
+  // (MAX_BOUNDED_CHOICES: a long counted run is slow to compile and to
+  // unwind) and to a product (MAX_WAYS, waysOf below).
   const info = (n) => {
     switch (n.t) {
       case 'star': case 'plus':
@@ -78,7 +89,7 @@ function simpleRule (ast) {
     }
   }
   const r = info(ast)
-  if (r === null || r.u > 1 || r.b > MAX_BOUNDED_CHOICES) return false
+  if (r === null || r.u > 1 || r.b > MAX_BOUNDED_CHOICES || !(waysOf(ast) <= MAX_WAYS)) return false
   return r.u === 0 || anchored(ast)
 }
 
@@ -207,9 +218,31 @@ function deterministicRule (ast) {
   for (let p = 0; p < sets.length && ok; p++) disjoint(follow[p])
   if (!ok) return false
   if (bounded > MAX_BOUNDED_CHOICES) return false
+  // A counted repeat of a body that can end in more than one place is not a
+  // loop to the walk above (`(a?){30}`, `(a{1,8}){8}`), and it is where the
+  // ways multiply: the same product as the simple rule holds here too.
+  if (!(waysOf(ast) <= MAX_WAYS)) return false
   return unbounded === 0 || anchored(ast)
 }
 
+// The product the simple rule counts, over any shape: an unbounded
+// quantifier adds no bounded choice of its own.
+function waysOf (n) {
+  switch (n.t) {
+    case 'star': case 'plus': return waysOf(n.child)
+    case 'quest': return atom(n.child) ? 2 : 1 + waysOf(n.child)
+    case 'repeat': {
+      if (n.max === Infinity) return waysOf(n.child)
+      if (atom(n.child)) return n.max - n.min + 1
+      return (n.max - n.min + 1) * Math.pow(waysOf(n.child), n.max)
+    }
+    case 'group': return waysOf(n.child)
+    case 'concat': { let w = 1; for (const part of n.parts) w *= waysOf(part); return w }
+    case 'alt': { let w = 0; for (const part of n.opts) w += waysOf(part); return w }
+    default: return 1
+  }
+}
+
 // Two more shapes the rules above decline, both anchored with `^` and `$`
 // around one top-level sequence.
 //
@@ -393,6 +426,11 @@ function nativeIsLinear (src) {
   }
   let ast
   try { ast = parse(src) } catch { return false }
+  // The product of the bounded choices holds for every rule below, so it is
+  // asked here, once: the one-choice and delimited-loop rules did not ask it,
+  // and `^(a*b)*` followed by thirty `a?` reached the platform RegExp, where
+  // each `a?` more doubles the time on a string that does not match.
+  if (!(waysOf(ast) <= MAX_WAYS)) return false
   return simpleRule(ast) || deterministicRule(ast) || oneChoiceRule(ast) || delimitedLoopRule(ast)
 }
 

package/lib/scan-compiler.js

@@ -981,6 +981,12 @@ function emitObject(schema, ctx, out, depth) {
   const reqMasks = new Array(words).fill(0);
   if (required) for (const k of required) { const x = bit.get(k); reqMasks[x.w] |= x.b; }
 
+  // Many names are dispatched on a hash of the key, and two names with one
+  // hash cannot be: the code below then took the other branch, which reads
+  // variables only the few-names form declares, and the scanner threw a
+  // ReferenceError on every document that carried a declared key. Such a
+  // schema is left to the parser.
+  if (names.length >= HASH_DISPATCH_MIN && new Set(names.map(spanHash)).size !== names.length) decline('properties:hash-collision');
   out.push('c=s.charCodeAt(++i);');
   const useHash = names.length >= HASH_DISPATCH_MIN;
   if (useHash) {

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.63.1';
+module.exports = '1.63.2';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.63.1",
+  "version": "1.63.2",
   "description": "JSON Schema validator that compiles to plain JavaScript, still runs where code generation is blocked, and can be compiled away at build time. Passes the full official test suite.",
   "type": "commonjs",
   "main": "index.js",
@@ -266,13 +266,13 @@
     "codegen.d.ts"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.63.1",
-    "@ata-validator/native-darwin-x64": "1.63.1",
-    "@ata-validator/native-linux-arm64-gnu": "1.63.1",
-    "@ata-validator/native-linux-arm64-musl": "1.63.1",
-    "@ata-validator/native-linux-x64-gnu": "1.63.1",
-    "@ata-validator/native-linux-x64-musl": "1.63.1",
-    "@ata-validator/native-win32-x64": "1.63.1"
+    "@ata-validator/native-darwin-arm64": "1.63.2",
+    "@ata-validator/native-darwin-x64": "1.63.2",
+    "@ata-validator/native-linux-arm64-gnu": "1.63.2",
+    "@ata-validator/native-linux-arm64-musl": "1.63.2",
+    "@ata-validator/native-linux-x64-gnu": "1.63.2",
+    "@ata-validator/native-linux-x64-musl": "1.63.2",
+    "@ata-validator/native-win32-x64": "1.63.2"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"