fast-json-stringify 1.15.0 → 1.15.4

package/test/ref.test.js

@@ -434,6 +434,206 @@ test('ref internal - plain name fragment', (t) => {
   t.equal(output, '{"obj":{"str":"test"}}')
 })
 
+test('ref external - plain name fragment', (t) => {
+  t.plan(2)
+
+  const externalSchema = {
+    first: {
+      $id: '#first-schema',
+      type: 'object',
+      properties: {
+        str: {
+          type: 'string'
+        }
+      }
+    },
+    second: {
+      definitions: {
+        second: {
+          $id: '#second-schema',
+          type: 'object',
+          properties: {
+            int: {
+              type: 'integer'
+            }
+          }
+        }
+      }
+    }
+  }
+
+  const schema = {
+    title: 'object with $ref to external plain name fragment',
+    type: 'object',
+    properties: {
+      first: {
+        $ref: '#first-schema'
+      },
+      second: {
+        $ref: '#second-schema'
+      }
+    }
+  }
+
+  const object = {
+    first: {
+      str: 'test'
+    },
+    second: {
+      int: 42
+    }
+  }
+
+  const stringify = build(schema, { schema: externalSchema })
+  const output = stringify(object)
+
+  try {
+    JSON.parse(output)
+    t.pass()
+  } catch (e) {
+    t.fail()
+  }
+
+  t.equal(output, '{"first":{"str":"test"},"second":{"int":42}}')
+})
+
+test('ref external - duplicate plain name fragment', (t) => {
+  t.plan(2)
+
+  const externalSchema = {
+    external: {
+      $id: '#duplicateSchema',
+      type: 'object',
+      properties: {
+        prop: {
+          type: 'boolean'
+        }
+      }
+    },
+    other: {
+      $id: '#otherSchema',
+      type: 'object',
+      properties: {
+        prop: {
+          type: 'integer'
+        }
+      }
+    }
+  }
+
+  const schema = {
+    title: 'object with $ref to plain name fragment',
+    type: 'object',
+    definitions: {
+      duplicate: {
+        $id: '#duplicateSchema',
+        type: 'object',
+        properties: {
+          prop: {
+            type: 'string'
+          }
+        }
+      }
+    },
+    properties: {
+      local: {
+        $ref: '#duplicateSchema'
+      },
+      external: {
+        $ref: 'external#duplicateSchema'
+      },
+      other: {
+        $ref: '#otherSchema'
+      }
+    }
+  }
+
+  const object = {
+    local: {
+      prop: 'test'
+    },
+    external: {
+      prop: true
+    },
+    other: {
+      prop: 42
+    }
+  }
+
+  const stringify = build(schema, { schema: externalSchema })
+  const output = stringify(object)
+
+  try {
+    JSON.parse(output)
+    t.pass()
+  } catch (e) {
+    t.fail()
+  }
+
+  t.equal(output, '{"local":{"prop":"test"},"external":{"prop":true},"other":{"prop":42}}')
+})
+
+test('ref external - explicit external plain name fragment must not fallback to other external schemas', (t) => {
+  t.plan(1)
+
+  const externalSchema = {
+    first: {
+      $id: '#target',
+      type: 'object',
+      properties: {
+        prop: {
+          type: 'string'
+        }
+      }
+    },
+    second: {
+      $id: '#wrong',
+      type: 'object',
+      properties: {
+        prop: {
+          type: 'integer'
+        }
+      }
+    }
+  }
+
+  const schema = {
+    title: 'object with $ref to plain name fragment',
+    type: 'object',
+    definitions: {
+      third: {
+        $id: '#wrong',
+        type: 'object',
+        properties: {
+          prop: {
+            type: 'boolean'
+          }
+        }
+      }
+    },
+    properties: {
+      target: {
+        $ref: 'first#wrong'
+      }
+    }
+  }
+
+  const object = {
+    target: {
+      prop: 'test'
+    }
+  }
+
+  try {
+    const stringify = build(schema, { schema: externalSchema })
+    const output = stringify(object)
+    JSON.parse(output)
+    t.fail()
+  } catch (e) {
+    t.pass()
+  }
+})
+
 test('ref internal - multiple $ref format', (t) => {
   t.plan(2)
 
@@ -484,3 +684,85 @@ test('ref internal - multiple $ref format', (t) => {
 
   t.equal(output, '{"zero":"test","a":"test","b":"test","c":"test","d":"test","e":"test"}')
 })
+
+test('ref in root external', (t) => {
+  t.plan(2)
+
+  const externalSchema = {
+    numbers: {
+      $id: 'numbers',
+      definitions: {
+        num: {
+          type: 'object',
+          properties: {
+            int: {
+              type: 'integer'
+            }
+          }
+        }
+      }
+    }
+  }
+
+  const schema = {
+    title: 'object with $ref in root schema',
+    type: 'object',
+    $ref: 'numbers#/definitions/num'
+  }
+
+  const object = { int: 42 }
+  const stringify = build(schema, { schema: externalSchema })
+  const output = stringify(object)
+
+  try {
+    JSON.parse(output)
+    t.pass()
+  } catch (e) {
+    t.fail()
+  }
+
+  t.equal(output, '{"int":42}')
+})
+
+test('ref in root external multiple times', (t) => {
+  t.plan(2)
+
+  const externalSchema = {
+    numbers: {
+      $id: 'numbers',
+      $ref: 'subnumbers#/definitions/num'
+    },
+    subnumbers: {
+      $id: 'subnumbers',
+      definitions: {
+        num: {
+          type: 'object',
+          properties: {
+            int: {
+              type: 'integer'
+            }
+          }
+        }
+      }
+    }
+  }
+
+  const schema = {
+    title: 'object with $ref in root schema',
+    type: 'object',
+    $ref: 'numbers#/definitions/num'
+  }
+
+  const object = { int: 42 }
+  const stringify = build(schema, { schema: externalSchema })
+  const output = stringify(object)
+
+  try {
+    JSON.parse(output)
+    t.pass()
+  } catch (e) {
+    t.fail()
+  }
+
+  t.equal(output, '{"int":42}')
+})

package/test/sanitize.test.js

@@ -0,0 +1,142 @@
+'use strict'
+
+const t = require('tap')
+const build = require('..')
+
+const stringify = build({
+  title: 'Example Schema',
+  type: 'object',
+  properties: {
+    firstName: {
+      type: 'string'
+    },
+    lastName: {
+      type: 'string'
+    },
+    age: {
+      description: 'Age in years"',
+      type: 'integer'
+    },
+    [(() => `phra'&& process.exit(1) ||'phra`)()]: {},
+    now: {
+      type: 'string'
+    },
+    reg: {
+      type: 'string',
+      default: 'a\'&& process.exit(1) ||\''
+    },
+    obj: {
+      type: 'object',
+      properties: {
+        bool: {
+          type: 'boolean'
+        }
+      }
+    },
+    '"\'w00t': {
+      type: 'string',
+      default: '"\'w00t'
+    },
+    arr: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          'phra\' && process.exit(1)//': {
+            type: 'number'
+          },
+          str: {
+            type: 'string'
+          }
+        }
+      }
+    }
+  },
+  required: ['now'],
+  patternProperties: {
+    '.*foo$': {
+      type: 'string'
+    },
+    test: {
+      type: 'number'
+    },
+    'phra\'/ && process.exit(1) && /\'': {
+      type: 'number'
+    },
+    '"\'w00t.*////': {
+      type: 'number'
+    }
+  },
+  additionalProperties: {
+    type: 'string'
+  }
+})
+
+const obj = {
+  firstName: 'Matteo',
+  lastName: 'Collina',
+  age: 32,
+  now: new Date(),
+  foo: 'hello"',
+  bar: "world'",
+  'fuzz"': 42,
+  "me'": 42,
+  numfoo: 42,
+  test: 42,
+  strtest: '23',
+  arr: [{ 'phra\' && process.exit(1)//': 42 }],
+  obj: { bool: true },
+  notmatch: 'valar morghulis',
+  notmatchobj: { a: true },
+  notmatchnum: 42
+}
+
+// pass if it does not crash
+const json = stringify(obj)
+JSON.parse(json)
+
+const stringify2 = build({
+  title: 'Example Schema',
+  type: 'object',
+  patternProperties: {
+    '"\'w00t.*////': {
+      type: 'number'
+    }
+  }
+})
+
+t.deepEqual(JSON.parse(stringify2({
+  '"\'phra////': 42,
+  asd: 42
+})), {
+})
+
+const stringify3 = build({
+  title: 'Example Schema',
+  type: 'object',
+  properties: {
+    "\"phra\\'&&(console.log(42))//||'phra": {}
+  }
+})
+
+// this verifies the escaping
+JSON.parse(stringify3({
+  '"phra\'&&(console.log(42))//||\'phra': 42
+}))
+
+const stringify4 = build({
+  title: 'Example Schema',
+  type: 'object',
+  properties: {
+    '"\\\\\\\\\'w00t': {
+      type: 'string',
+      default: '"\'w00t'
+    }
+  }
+})
+
+t.deepEqual(JSON.parse(stringify4({})), {
+  '"\\\\\\\\\'w00t': '"\'w00t'
+})
+
+t.pass('no crashes')