fast-json-stringify 7.0.1 → 7.1.1

package/lib/location.js

@@ -8,10 +8,12 @@ class Location {
   }
 
   getPropertyLocation (propertyName) {
+    // a JSON pointer segment, so a property name with a / or a ~ still points at the property
+    const segment = String(propertyName).replace(/~/g, '~0').replace(/\//g, '~1')
     const propertyLocation = new Location(
       this.schema[propertyName],
       this.schemaId,
-      this.jsonPointer + '/' + propertyName
+      this.jsonPointer + '/' + segment
     )
     return propertyLocation
   }

package/lib/serializer.js

@@ -3,6 +3,43 @@
 // eslint-disable-next-line
 const STR_ESCAPE = /[\u0000-\u001f\u0022\u005c\ud800-\udfff]/
 
+function asString (str) {
+  const len = str.length
+  if (len === 0) {
+    return '""'
+  } else if (len < 42) {
+    // magically escape strings for json
+    // relying on their charCodeAt
+    // everything below 32 needs JSON.stringify()
+    // every string that contain surrogate needs JSON.stringify()
+    // 34 and 92 happens all the time, so we
+    // have a fast case for them
+    let result = ''
+    let last = -1
+    let point = 255
+    for (let i = 0; i < len; i++) {
+      point = str.charCodeAt(i)
+      if (
+        point === 0x22 || // '"'
+        point === 0x5c // '\'
+      ) {
+        last === -1 && (last = 0)
+        result += str.slice(last, i) + '\\'
+        last = i
+      } else if (point < 32 || (point >= 0xD800 && point <= 0xDFFF)) {
+        // The current character is non-printable characters or a surrogate.
+        return JSON.stringify(str)
+      }
+    }
+    return (last === -1 && ('"' + str + '"')) || ('"' + result + str.slice(last) + '"')
+  } else if (len < 5000 && STR_ESCAPE.test(str) === false) {
+    // Only use the regular expression for shorter input. The overhead is otherwise too much.
+    return '"' + str + '"'
+  } else {
+    return JSON.stringify(str)
+  }
+}
+
 module.exports = class Serializer {
   constructor (options) {
     switch (options && options.rounding) {
@@ -63,7 +100,7 @@ module.exports = class Serializer {
       return '"' + date.toISOString() + '"'
     }
     if (typeof date === 'string') {
-      return '"' + date + '"'
+      return asString(date)
     }
     throw new Error(`The value "${date}" cannot be converted to a date-time.`)
   }
@@ -74,7 +111,7 @@ module.exports = class Serializer {
       return '"' + new Date(date.getTime() - (date.getTimezoneOffset() * 60000)).toISOString().slice(0, 10) + '"'
     }
     if (typeof date === 'string') {
-      return '"' + date + '"'
+      return asString(date)
     }
     throw new Error(`The value "${date}" cannot be converted to a date.`)
   }
@@ -85,46 +122,13 @@ module.exports = class Serializer {
       return '"' + new Date(date.getTime() - (date.getTimezoneOffset() * 60000)).toISOString().slice(11, 19) + '"'
     }
     if (typeof date === 'string') {
-      return '"' + date + '"'
+      return asString(date)
     }
     throw new Error(`The value "${date}" cannot be converted to a time.`)
   }
 
   asString (str) {
-    const len = str.length
-    if (len === 0) {
-      return '""'
-    } else if (len < 42) {
-      // magically escape strings for json
-      // relying on their charCodeAt
-      // everything below 32 needs JSON.stringify()
-      // every string that contain surrogate needs JSON.stringify()
-      // 34 and 92 happens all the time, so we
-      // have a fast case for them
-      let result = ''
-      let last = -1
-      let point = 255
-      for (let i = 0; i < len; i++) {
-        point = str.charCodeAt(i)
-        if (
-          point === 0x22 || // '"'
-          point === 0x5c // '\'
-        ) {
-          last === -1 && (last = 0)
-          result += str.slice(last, i) + '\\'
-          last = i
-        } else if (point < 32 || (point >= 0xD800 && point <= 0xDFFF)) {
-          // The current character is non-printable characters or a surrogate.
-          return JSON.stringify(str)
-        }
-      }
-      return (last === -1 && ('"' + str + '"')) || ('"' + result + str.slice(last) + '"')
-    } else if (len < 5000 && STR_ESCAPE.test(str) === false) {
-      // Only use the regular expression for shorter input. The overhead is otherwise too much.
-      return '"' + str + '"'
-    } else {
-      return JSON.stringify(str)
-    }
+    return asString(str)
   }
 
   asUnsafeString (str) {

package/lib/standalone.js

@@ -3,9 +3,28 @@
 function buildStandaloneCode (contextFunc, context, serializer, validator) {
   let ajvDependencyCode = ''
   if (context.validatorSchemasIds.size > 0) {
-    ajvDependencyCode += 'const Validator = require(\'fast-json-stringify/lib/validator\')\n'
-    ajvDependencyCode += `const validatorState = ${JSON.stringify(validator.getState())}\n`
-    ajvDependencyCode += 'const validator = Validator.restoreFromState(validatorState)\n'
+    if (context.options.inlineValidators) {
+      const standaloneCode = require('ajv/dist/standalone').default
+      const schemaRefs = Object.fromEntries(
+        [...context.validatorSchemaRefs].map(schemaRef => [schemaRef, schemaRef])
+      )
+
+      ajvDependencyCode += `const validator = (() => {
+        const validators = {}
+        const exports = validators
+        ${standaloneCode(validator.ajv, schemaRefs)}
+        return {
+          validate (schemaRef, data) {
+            const validate = validators[schemaRef]
+            return validate(data)
+          }
+        }
+      })()\n`
+    } else {
+      ajvDependencyCode += 'const Validator = require(\'fast-json-stringify/lib/validator\')\n'
+      ajvDependencyCode += `const validatorState = ${JSON.stringify(validator.getState())}\n`
+      ajvDependencyCode += 'const validator = Validator.restoreFromState(validatorState)\n'
+    }
   } else {
     ajvDependencyCode += 'const validator = null\n'
   }

package/lib/validator.js

@@ -1,14 +1,20 @@
 'use strict'
 
 const Ajv = require('ajv')
+const { _ } = Ajv
 const fastUri = require('fast-uri')
 const ajvFormats = require('ajv-formats')
 const clone = require('rfdc')({ proto: true })
 
 class Validator {
-  constructor (ajvOptions) {
+  constructor (ajvOptions, inlineValidators) {
+    const codeOptions = inlineValidators
+      ? { code: { ...ajvOptions?.code, source: true, esm: false } }
+      : {}
+
     this.ajv = new Ajv({
       ...ajvOptions,
+      ...codeOptions,
       strictSchema: false,
       validateSchema: false,
       allowUnionTypes: true,
@@ -21,8 +27,9 @@ class Validator {
       keyword: 'fjs_type',
       type: 'object',
       errors: false,
-      validate: (_type, data) => {
-        return data && typeof data.toJSON === 'function'
+      code (context) {
+        const { data } = context
+        context.fail(_`!${data} || typeof ${data}.toJSON !== "function"`)
       }
     })
 
@@ -47,6 +54,18 @@ class Validator {
     }
   }
 
+  // Ajv compiles a schema lazily, on the first `validate` call for a given ref.
+  // That cost would otherwise be paid at serialization time, on the first
+  // document that exercises the union/if-then-else branch. Eagerly resolving
+  // every ref the generated code can validate against moves it to build time.
+  // It must run after every `addSchema` call: compiling resolves $refs, so
+  // doing it earlier breaks on forward references.
+  compileSchemas (schemaRefs) {
+    for (const schemaRef of schemaRefs) {
+      this.ajv.getSchema(schemaRef)
+    }
+  }
+
   validate (schemaRef, data) {
     return this.ajv.validate(schemaRef, data)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fast-json-stringify",
-  "version": "7.0.1",
+  "version": "7.1.1",
   "description": "Stringify your JSON at max speed",
   "main": "index.js",
   "type": "commonjs",
@@ -13,7 +13,7 @@
     "lint": "eslint",
     "lint:fix": "eslint --fix",
     "test:typescript": "tstyche",
-    "test:unit": "c8 node --test",
+    "test:unit": "c8 --100 --all --include=index.js --include=lib/**/*.js --exclude=lib/schema-validator.js node --test",
     "test": "npm run test:unit && npm run test:typescript"
   },
   "repository": {
@@ -62,15 +62,14 @@
     }
   ],
   "devDependencies": {
-    "c8": "^11.0.0",
+    "c8": "^12.0.0",
     "cli-select": "^1.1.2",
     "compile-json-stringify": "^0.1.2",
     "eslint": "^9.39.2",
     "fast-json-stringify": ".",
-    "is-my-json-valid": "^2.20.6",
     "json-accelerator": "^0.1.7",
     "neostandard": "^0.13.0",
-    "simple-git": "^3.30.0",
+    "simple-git": "^4.0.2",
     "tinybench": "^6.0.0",
     "tstyche": "^7.1.0",
     "typebox": "^1.0.81",

package/test/additionalProperties.test.js

@@ -377,3 +377,43 @@ test('required key not in properties + additionalProperties produces valid JSON'
   t.assert.equal(out, '{"str":"x"}')
   t.assert.deepStrictEqual(JSON.parse(out), { str: 'x' })
 })
+
+test('additionalProperties set to false ignores properties not matched by patternProperties', (t) => {
+  // Regression: `additionalProperties: false` is documented to drop every
+  // property that is not listed in `properties` or matched by
+  // `patternProperties`. Combined with `patternProperties`, the generated
+  // code used to fall through to the additionalProperties branch with a
+  // boolean `false` schema, which serialized unmatched properties with
+  // `JSON.stringify(value)` and leaked them into the output:
+  //   {"nickname":"nick","matchnum":3,"leaked":"secret"}
+  t.plan(2)
+  const stringify = build({
+    type: 'object',
+    properties: {
+      nickname: { type: 'string' }
+    },
+    patternProperties: {
+      num: { type: 'number' }
+    },
+    additionalProperties: false
+  })
+
+  const out = stringify({ nickname: 'nick', matchnum: 3, leaked: 'secret' })
+  t.assert.equal(out, '{"nickname":"nick","matchnum":3}')
+  t.assert.deepStrictEqual(JSON.parse(out), { nickname: 'nick', matchnum: 3 })
+})
+
+test('additionalProperties set to false without declared properties ignores unmatched properties', (t) => {
+  t.plan(2)
+  const stringify = build({
+    type: 'object',
+    patternProperties: {
+      '^str': { type: 'string' }
+    },
+    additionalProperties: false
+  })
+
+  const out = stringify({ str1: 'a', leaked: 'secret' })
+  t.assert.equal(out, '{"str1":"a"}')
+  t.assert.deepStrictEqual(JSON.parse(out), { str1: 'a' })
+})

package/test/anyof.test.js

@@ -387,6 +387,48 @@ test('anyOf and $ref - multiple external $ref', (t) => {
   t.assert.equal(output, '{"obj":{"prop":{"prop2":"test"}}}')
 })
 
+test('anyOf with registered $ref branches validates directly against the ref target', (t) => {
+  t.plan(3)
+
+  const schema = {
+    title: 'anyOf with registered $ref branches',
+    type: 'object',
+    properties: {
+      content: {
+        anyOf: [
+          { $ref: 'Foo#' },
+          { $ref: 'Bar#/definitions/Baz' }
+        ]
+      }
+    }
+  }
+  const externalSchema = {
+    Foo: {
+      type: 'object',
+      properties: { a: { type: 'string' } },
+      required: ['a'],
+      additionalProperties: false
+    },
+    Bar: {
+      definitions: {
+        Baz: {
+          type: 'object',
+          properties: { b: { type: 'string' } },
+          required: ['b'],
+          additionalProperties: false
+        }
+      }
+    }
+  }
+
+  const code = build(schema, { mode: 'standalone', schema: externalSchema })
+  t.assert.ok(code.includes('validator.validate("Foo#"'), 'validates directly against the bare registered id')
+  t.assert.ok(code.includes('validator.validate("Bar#/definitions/Baz"'), 'validates directly against the registered sub-path ref')
+
+  const stringify = build(schema, { schema: externalSchema })
+  t.assert.equal(stringify({ content: { b: 'yo' } }), '{"content":{"b":"yo"}}')
+})
+
 test('anyOf looks for all of the array items', (t) => {
   t.plan(1)
 

package/test/array.test.js

@@ -1,7 +1,7 @@
 'use strict'
 
 const { test } = require('node:test')
-const validator = require('is-my-json-valid')
+const validator = require('./utils/validator')
 const build = require('..')
 const Ajv = require('ajv')
 
@@ -23,6 +23,31 @@ test('error on invalid largeArrayMechanism', (t) => {
   }), Error('Unsupported large array mechanism invalid'))
 })
 
+test('does not leak largeArrayMechanism across build() calls', (t) => {
+  t.plan(2)
+
+  const users = []
+  for (let i = 0; i < 100; i++) users.push({ name: 'user' + i, password: 'secret' + i })
+
+  const schema = {
+    type: 'array',
+    items: {
+      type: 'object',
+      properties: {
+        name: { type: 'string' }
+      }
+    }
+  }
+
+  // An unrelated build() opts into json-stringify for its own schema.
+  const optedIn = build({ type: 'array' }, { largeArrayMechanism: 'json-stringify', largeArraySize: 100 })
+  t.assert.equal(optedIn(users).includes('password'), true)
+
+  // A later build() without options must not inherit the mechanism.
+  const stringify = build(schema)
+  t.assert.equal(stringify(users).includes('password'), false)
+})
+
 function buildTest (schema, toStringify, options) {
   test(`render a ${schema.title} as JSON`, (t) => {
     t.plan(3)

package/test/basic.test.js

@@ -1,7 +1,7 @@
 'use strict'
 
 const { test } = require('node:test')
-const validator = require('is-my-json-valid')
+const validator = require('./utils/validator')
 const build = require('..')
 
 function buildTest (schema, toStringify) {

package/test/code-generation-fallbacks.test.js

@@ -0,0 +1,158 @@
+'use strict'
+
+const { test } = require('node:test')
+
+const OriginalLocation = require('../lib/location')
+
+const buildPath = require.resolve('..')
+const locationPath = require.resolve('../lib/location')
+
+function loadBuildWithLocation (Location) {
+  require.cache[locationPath].exports = Location
+  delete require.cache[buildPath]
+
+  try {
+    return require(buildPath)
+  } finally {
+    require.cache[locationPath].exports = OriginalLocation
+    delete require.cache[buildPath]
+  }
+}
+
+class LocationWithoutSchemaId {
+  constructor (schema, _schemaId, jsonPointer = '#') {
+    this.schema = schema
+    this.schemaId = ''
+    this.jsonPointer = _schemaId ? _schemaId + jsonPointer : jsonPointer
+  }
+
+  getPropertyLocation (propertyName) {
+    return new LocationWithoutSchemaId(
+      this.schema[propertyName],
+      '',
+      this.jsonPointer + '/' + propertyName
+    )
+  }
+
+  getSchemaRef () {
+    return this.schemaId + this.jsonPointer
+  }
+}
+
+class LocationWithoutJsonPointer {
+  constructor (schema, schemaId) {
+    this.schema = schema
+    this.schemaId = schemaId
+    this.jsonPointer = ''
+  }
+
+  getPropertyLocation (propertyName) {
+    return new LocationWithoutJsonPointer(this.schema[propertyName], this.schemaId)
+  }
+
+  getSchemaRef () {
+    return this.schemaId
+  }
+}
+
+class LocationWithoutSchemaRef extends OriginalLocation {
+  getSchemaRef () {}
+}
+
+test('inline object generation without schema IDs', t => {
+  t.plan(3)
+
+  const build = loadBuildWithLocation(LocationWithoutSchemaId)
+  const stringify = build({
+    type: 'object',
+    properties: {
+      value: { type: 'string' }
+    }
+  })
+  const stringifyNullable = build({ type: 'object', nullable: true })
+
+  t.assert.equal(stringify({ value: 'test' }), '{"value":"test"}')
+  t.assert.equal(stringify(null), '{}')
+  t.assert.equal(stringifyNullable(null), 'null')
+})
+
+test('inline array generation without schema IDs', t => {
+  t.plan(6)
+
+  const build = loadBuildWithLocation(LocationWithoutSchemaId)
+  const stringify = build({ type: 'array', items: { type: 'string' } }, { largeArrayMechanism: 'default' })
+  const stringifyNullable = build({ type: 'array', nullable: true })
+  const stringifyTuple = build({
+    type: 'array',
+    items: [{ $ref: 'item' }, { type: 'number' }],
+    additionalItems: true
+  }, {
+    schema: {
+      item: { type: 'string' }
+    }
+  })
+  const stringifyFixedTuple = build({
+    type: 'array',
+    items: [{ type: 'string' }],
+    additionalItems: false
+  })
+  const stringifyLargeArray = build({ type: 'array', items: { type: 'number' } }, {
+    largeArrayMechanism: 'json-stringify',
+    largeArraySize: 1
+  })
+
+  t.assert.equal(stringify(['one', 'two']), '["one","two"]')
+  t.assert.equal(stringifyNullable(null), 'null')
+  t.assert.equal(stringifyTuple(['one', 2, true]), '["one",2,true]')
+  t.assert.throws(() => stringifyFixedTuple(['one', 'two']), /Item at 1/)
+  t.assert.equal(stringifyLargeArray([1, 2]), '[1,2]')
+  t.assert.throws(() => stringify('not-an-array'), /does not match schema definition/)
+})
+
+test('code generation reference fallbacks', t => {
+  t.plan(3)
+
+  const buildWithoutPointer = loadBuildWithLocation(LocationWithoutJsonPointer)
+  const stringifyObject = buildWithoutPointer({ type: 'object' })
+  const stringifyArray = buildWithoutPointer({ type: 'array' })
+
+  const buildWithoutRef = loadBuildWithLocation(LocationWithoutSchemaRef)
+  const stringifyWithoutRef = buildWithoutRef({ type: 'object' })
+
+  t.assert.equal(stringifyObject({}), '{}')
+  t.assert.equal(stringifyArray([]), '[]')
+  t.assert.equal(stringifyWithoutRef({}), '{}')
+})
+
+test('required-property fallback tolerates unexpected property ordering', t => {
+  t.plan(2)
+
+  const originalSort = Array.prototype.sort
+  // Deliberately fault-inject unexpected ordering to exercise the defensive branch.
+  // eslint-disable-next-line no-extend-native
+  Array.prototype.sort = function (compareFn) {
+    const result = originalSort.call(this, compareFn)
+    if (this.length === 2 && this.includes('optional') && this.includes('required')) {
+      result.reverse()
+    }
+    return result
+  }
+
+  try {
+    const build = loadBuildWithLocation(OriginalLocation)
+    const stringify = build({
+      type: 'object',
+      properties: {
+        optional: { type: 'string' },
+        required: { type: 'string' }
+      },
+      required: ['required']
+    })
+
+    t.assert.equal(stringify({ optional: 'one', required: 'two' }), '{"optional":"one","required":"two"}')
+    t.assert.throws(() => stringify({ optional: 'one' }), /"required" is required/)
+  } finally {
+    // eslint-disable-next-line no-extend-native
+    Array.prototype.sort = originalSort
+  }
+})

package/test/compile-validators.test.js

@@ -0,0 +1,110 @@
+'use strict'
+
+const { test } = require('node:test')
+const fjs = require('..')
+
+const schema = {
+  title: 'compile validators',
+  type: 'object',
+  properties: {
+    union: {
+      anyOf: [
+        { type: 'string' },
+        { type: 'number' }
+      ]
+    },
+    choice: {
+      oneOf: [
+        { type: 'object', properties: { a: { type: 'string' } }, required: ['a'] },
+        { type: 'object', properties: { b: { type: 'number' } }, required: ['b'] }
+      ]
+    },
+    conditional: {
+      if: { type: 'string' },
+      then: { type: 'string' },
+      else: { type: 'number' }
+    }
+  }
+}
+
+// The refs the generated code validates against, straight out of the emitted
+// source, so the assertions cannot drift from what fjs actually calls.
+function getValidatorRefs (code) {
+  return [...code.matchAll(/validator\.validate\("([^"]+)"/g)].map(match => match[1])
+}
+
+// Ajv stores a compiled schema as a SchemaEnv with a `validate` function.
+// `getSchema()` is not used here because it compiles on demand, which is the
+// very thing under test.
+function isCompiled (ajv, ref) {
+  const schemaEnv = ajv.refs[ref] || ajv.schemas[ref]
+  return schemaEnv !== undefined && typeof schemaEnv.validate === 'function'
+}
+
+test('validators are compiled lazily by default', t => {
+  t.plan(2)
+
+  const { code, ajv } = fjs(schema, { mode: 'debug' })
+  const refs = getValidatorRefs(code)
+
+  t.assert.ok(refs.length > 0)
+  t.assert.deepStrictEqual(refs.filter(ref => isCompiled(ajv, ref)), [])
+})
+
+test('compileValidators compiles every validator used by the generated code', t => {
+  t.plan(2)
+
+  const { code, ajv } = fjs(schema, { mode: 'debug', compileValidators: true })
+  const refs = getValidatorRefs(code)
+
+  t.assert.ok(refs.length > 0)
+  t.assert.deepStrictEqual(refs.filter(ref => !isCompiled(ajv, ref)), [])
+})
+
+test('compileValidators does not change the serialization output', t => {
+  t.plan(2)
+
+  const input = {
+    union: 'foo',
+    choice: { b: 42 },
+    conditional: 'bar'
+  }
+  const expected = JSON.stringify({ union: 'foo', choice: { b: 42 }, conditional: 'bar' })
+
+  t.assert.equal(fjs(schema)(input), expected)
+  t.assert.equal(fjs(schema, { compileValidators: true })(input), expected)
+})
+
+test('compileValidators works with external schemas resolved after registration', t => {
+  t.plan(3)
+
+  const externalSchema = {
+    branch: {
+      $id: 'branch',
+      definitions: {
+        str: { type: 'string' },
+        num: { type: 'number' }
+      },
+      type: 'object',
+      properties: {
+        value: {
+          anyOf: [
+            { $ref: 'branch#/definitions/str' },
+            { $ref: 'branch#/definitions/num' }
+          ]
+        }
+      }
+    }
+  }
+
+  const rootSchema = { $ref: 'branch#' }
+  const options = { schema: externalSchema, compileValidators: true }
+
+  const { code, ajv } = fjs(rootSchema, { ...options, mode: 'debug' })
+  const refs = getValidatorRefs(code)
+
+  t.assert.ok(refs.length > 0)
+  t.assert.deepStrictEqual(refs.filter(ref => !isCompiled(ajv, ref)), [])
+
+  t.assert.equal(fjs(rootSchema, options)({ value: 7 }), JSON.stringify({ value: 7 }))
+})