joi 18.2.1 → 18.2.6

package/lib/annotate.js

@@ -147,12 +147,12 @@ internals.serializer = function () {
                     value = annotated;
                 }
                 else {
-                    for (const errorKey in annotations.errors) {
+                    for (const errorKey of Object.keys(annotations.errors)) {
                         value[`${errorKey}_$key$_${annotations.errors[errorKey].sort().join(', ')}_$end$_`] = value[errorKey];
                         value[errorKey] = undefined;
                     }
 
-                    for (const missingKey in annotations.missing) {
+                    for (const missingKey of Object.keys(annotations.missing)) {
                         value[`_$miss$_${missingKey}|${annotations.missing[missingKey]}_$end$_`] = '__missing__';
                     }
                 }

package/lib/base.js

@@ -118,7 +118,7 @@ internals.Base = class {
 
         for (const rule of this._rules) {
             const definition = this._definition.rules[rule.name];
-            if (definition.jsonSchema && typesOverlap) {
+            if (definition.jsonSchema && typesOverlap && !rule._resolve.length) {
                 schema = definition.jsonSchema(rule, schema, isOnly, mode, subOptions);
             }
         }
@@ -244,7 +244,7 @@ internals.Base = class {
 
         const obj = this.clone();
         obj.$_terms.alterations = obj.$_terms.alterations || [];
-        for (const target in targets) {
+        for (const target of Object.keys(targets)) {
             const adjuster = targets[target];
             assert(typeof adjuster === 'function', 'Alteration adjuster for', target, 'must be a function');
             obj.$_terms.alterations.push({ target, adjuster });
@@ -579,7 +579,7 @@ internals.Base = class {
 
         // Terms
 
-        for (const key in source.$_terms) {
+        for (const key of Object.keys(source.$_terms)) {
             const terms = source.$_terms[key];
             if (!terms) {
                 if (!obj.$_terms[key]) {
@@ -683,7 +683,7 @@ internals.Base = class {
             const original = obj._rules[i];
             const rule = clone(original);
 
-            for (const name in options) {
+            for (const name of Object.keys(options)) {
                 def.modifiers[name](rule, options[name]);
                 assert(rule.name === original.name, 'Cannot change rule name');
             }
@@ -763,7 +763,7 @@ internals.Base = class {
         assert(options && typeof options === 'object', 'Invalid options');
         assert(options.name && typeof options.name === 'string', 'Invalid rule name');
 
-        for (const key in options) {
+        for (const key of Object.keys(options)) {
             assert(key[0] !== '_', 'Cannot set private rule properties');
         }
 
@@ -783,7 +783,7 @@ internals.Base = class {
         if (args) {
             assert(Object.keys(args).length === 1 || Object.keys(args).length === this._definition.rules[rule.name].args.length, 'Invalid rule definition for', this.type, rule.name);
 
-            for (const key in args) {
+            for (const key of Object.keys(args)) {
                 let arg = args[key];
 
                 if (definition.argsByName) {
@@ -993,15 +993,17 @@ internals.Base = class {
         target._cache = null;
 
         target.$_terms = {};
-        for (const key in this.$_terms) {
+        for (const key of Object.keys(this.$_terms)) {
             target.$_terms[key] = this.$_terms[key] ? this.$_terms[key].slice() : null;
         }
 
         // Backwards compatibility
 
         target.$_super = {};
-        for (const override in this.$_super) {
-            target.$_super[override] = this._super[override].bind(target);
+        if (this.$_super) {
+            for (const override of Object.keys(this.$_super)) {
+                target.$_super[override] = this._super[override].bind(target);
+            }
         }
 
         return target;
@@ -1013,7 +1015,7 @@ internals.Base = class {
         obj._reset();
 
         const terms = obj._definition.terms;
-        for (const name in terms) {
+        for (const name of Object.keys(terms)) {
             const term = terms[name];
             obj.$_terms[name] = term.init;
         }

package/lib/compile.js

@@ -152,7 +152,7 @@ internals.walk = function (schema) {
 
     assert(Object.getPrototypeOf(schema) === Object.getPrototypeOf({}), 'Schema can only contain plain objects');
 
-    for (const key in schema) {
+    for (const key of Object.keys(schema)) {
         const compiler = internals.walk(schema[key]);
         if (compiler) {
             return compiler;

package/lib/extend.js

@@ -35,7 +35,7 @@ exports.type = function (from, options) {
 
     const terms = Object.assign({}, parent.terms);
     if (def.terms) {
-        for (const name in def.terms) {                                     // Only apply own terms
+        for (const name of Object.keys(def.terms)) {                        // Only apply own terms
             const term = def.terms[name];
             assert(schema.$_terms[name] === undefined, 'Invalid term override for', def.type, name);
             schema.$_terms[name] = term.init;
@@ -79,7 +79,7 @@ exports.type = function (from, options) {
 
     const rules = Object.assign({}, parent.rules);
     if (def.rules) {
-        for (const name in def.rules) {
+        for (const name of Object.keys(def.rules)) {
             const rule = def.rules[name];
             assert(typeof rule === 'object', 'Invalid rule definition for', def.type, name);
 
@@ -139,7 +139,7 @@ exports.type = function (from, options) {
 
     const modifiers = Object.assign({}, parent.modifiers);
     if (def.modifiers) {
-        for (const name in def.modifiers) {
+        for (const name of Object.keys(def.modifiers)) {
             assert(!prototype[name], 'Rule conflict in', def.type, name);
 
             const modifier = def.modifiers[name];
@@ -162,7 +162,7 @@ exports.type = function (from, options) {
     if (def.overrides) {
         prototype._super = base;
         schema.$_super = {};                                                            // Backwards compatibility
-        for (const override in def.overrides) {
+        for (const override of Object.keys(def.overrides)) {
             assert(base[override], 'Cannot override missing', override);
             def.overrides[override][Common.symbols.parent] = base[override];
             schema.$_super[override] = base[override].bind(schema);                     // Backwards compatibility

package/lib/index.js

@@ -73,7 +73,7 @@ internals.root = function () {
 
     // Aliases
 
-    for (const alias in internals.aliases) {
+    for (const alias of Object.keys(internals.aliases)) {
         const target = internals.aliases[alias];
         root[alias] = root[target];
     }
@@ -206,7 +206,7 @@ internals.methods = {
             types[type] = this[type]();
         }
 
-        for (const target in internals.aliases) {
+        for (const target of Object.keys(internals.aliases)) {
             types[target] = this[target]();
         }
 

package/lib/manifest.js

@@ -27,7 +27,7 @@ exports.describe = function (schema) {
 
     // Flags
 
-    for (const flag in schema._flags) {
+    for (const flag of Object.keys(schema._flags)) {
         if (flag[0] !== '_') {
             desc.flags[flag] = internals.describe(schema._flags[flag]);
         }
@@ -67,7 +67,7 @@ exports.describe = function (schema) {
 
         const item = { name: rule.name };
 
-        for (const custom in def.modifiers) {
+        for (const custom of Object.keys(def.modifiers)) {
             if (rule[custom] !== undefined) {
                 item[custom] = internals.describe(rule[custom]);
             }
@@ -75,7 +75,7 @@ exports.describe = function (schema) {
 
         if (rule.args) {
             item.args = {};
-            for (const key in rule.args) {
+            for (const key of Object.keys(rule.args)) {
                 const arg = rule.args[key];
                 if (key === 'options' &&
                     !Object.keys(arg).length) {
@@ -100,7 +100,7 @@ exports.describe = function (schema) {
 
     // Terms (must be last to verify no name conflicts)
 
-    for (const term in schema.$_terms) {
+    for (const term of Object.keys(schema.$_terms)) {
         if (term[0] === '_') {
             continue;
         }
@@ -222,7 +222,7 @@ internals.describe = function (item, options = {}) {
     }
 
     const normalized = {};
-    for (const key in item) {
+    for (const key of Object.keys(item)) {
         const value = item[key];
         if (value === undefined) {
             continue;
@@ -261,7 +261,7 @@ internals.Builder = class {
         // Flags
 
         if (desc.flags) {
-            for (const flag in desc.flags) {
+            for (const flag of Object.keys(desc.flags)) {
                 const setter = def.flags[flag] && def.flags[flag].setter || flag;
                 assert(typeof schema[setter] === 'function', 'Invalid flag', flag, 'for type', desc.type);
                 schema = schema[setter](this.build(desc.flags[flag]));
@@ -293,7 +293,7 @@ internals.Builder = class {
                 const args = [];
                 if (rule.args) {
                     const built = {};
-                    for (const key in rule.args) {
+                    for (const key of Object.keys(rule.args)) {
                         built[key] = this.build(rule.args[key], { assign: key });
                     }
 
@@ -318,7 +318,7 @@ internals.Builder = class {
                 // Ruleset
 
                 const options = {};
-                for (const custom in def.modifiers) {
+                for (const custom of Object.keys(def.modifiers)) {
                     if (rule[custom] !== undefined) {
                         options[custom] = this.build(rule[custom]);
                     }
@@ -333,7 +333,7 @@ internals.Builder = class {
         // Terms
 
         const terms = {};
-        for (const key in desc) {
+        for (const key of Object.keys(desc)) {
             if (['allow', 'flags', 'invalid', 'whens', 'preferences', 'rules', 'type'].includes(key)) {
                 continue;
             }
@@ -358,7 +358,7 @@ internals.Builder = class {
 
             if (typeof manifest === 'object') {
                 terms[key] = {};
-                for (const name in desc[key]) {
+                for (const name of Object.keys(desc[key])) {
                     const value = desc[key][name];
                     terms[key][name] = this.parse(value);
                 }
@@ -449,7 +449,7 @@ internals.Builder = class {
         }
 
         const normalized = {};
-        for (const key in desc) {
+        for (const key of Object.keys(desc)) {
             normalized[key] = this.build(desc[key], { assign: key });
         }
 

package/lib/messages.js

@@ -30,7 +30,7 @@ exports.compile = function (messages, target) {
 
     target = target ? clone(target) : {};
 
-    for (let code in messages) {
+    for (const code of Object.keys(messages)) {
         const message = messages[code];
 
         if (code === 'root' ||
@@ -50,20 +50,24 @@ exports.compile = function (messages, target) {
         assert(typeof message === 'object' && !Array.isArray(message), 'Invalid message for', code);
 
         const language = code;
-        target[language] = target[language] || {};
 
-        for (code in message) {
-            const localized = message[code];
+        // Don't reuse an inherited object, otherwise a language named __proto__ or constructor writes on the prototype
 
-            if (code === 'root' ||
+        const localizedTarget = Object.hasOwn(target, language) ? target[language] : {};
+        target[language] = localizedTarget;
+
+        for (const key of Object.keys(message)) {
+            const localized = message[key];
+
+            if (key === 'root' ||
                 Template.isTemplate(localized)) {
 
-                target[language][code] = localized;
+                localizedTarget[key] = localized;
                 continue;
             }
 
-            assert(typeof localized === 'string', 'Invalid message for', code, 'in', language);
-            target[language][code] = new Template(localized);
+            assert(typeof localized === 'string', 'Invalid message for', key, 'in', language);
+            localizedTarget[key] = new Template(localized);
         }
     }
 
@@ -76,7 +80,7 @@ exports.decompile = function (messages) {
     // By error code { 'number.min': <string | template> }
 
     const target = {};
-    for (let code in messages) {
+    for (const code of Object.keys(messages)) {
         const message = messages[code];
 
         if (code === 'root') {
@@ -94,15 +98,15 @@ exports.decompile = function (messages) {
         const language = code;
         target[language] = {};
 
-        for (code in message) {
-            const localized = message[code];
+        for (const key of Object.keys(message)) {
+            const localized = message[key];
 
-            if (code === 'root') {
+            if (key === 'root') {
                 target[language].root = localized;
                 continue;
             }
 
-            target[language][code] = localized.describe({ compact: true });
+            target[language][key] = localized.describe({ compact: true });
         }
     }
 
@@ -136,7 +140,7 @@ exports.merge = function (base, extended) {
 
     const target = clone(base);
 
-    for (let code in extended) {
+    for (const code of Object.keys(extended)) {
         const message = extended[code];
 
         if (code === 'root' ||
@@ -156,20 +160,24 @@ exports.merge = function (base, extended) {
         assert(typeof message === 'object' && !Array.isArray(message), 'Invalid message for', code);
 
         const language = code;
-        target[language] = target[language] || {};
 
-        for (code in message) {
-            const localized = message[code];
+        // Same as in compile(), don't reuse an inherited object
+
+        const localizedTarget = Object.hasOwn(target, language) ? target[language] : {};
+        target[language] = localizedTarget;
+
+        for (const key of Object.keys(message)) {
+            const localized = message[key];
 
-            if (code === 'root' ||
+            if (key === 'root' ||
                 Template.isTemplate(localized)) {
 
-                target[language][code] = localized;
+                localizedTarget[key] = localized;
                 continue;
             }
 
-            assert(typeof localized === 'string', 'Invalid message for', code, 'in', language);
-            target[language][code] = new Template(localized);
+            assert(typeof localized === 'string', 'Invalid message for', key, 'in', language);
+            localizedTarget[key] = new Template(localized);
         }
     }
 

package/lib/modify.js

@@ -171,7 +171,7 @@ exports.schema = function (schema, options) {
 
     let obj;
 
-    for (const name in schema._flags) {
+    for (const name of Object.keys(schema._flags)) {
         if (name[0] === '_') {
             continue;
         }
@@ -199,7 +199,7 @@ exports.schema = function (schema, options) {
         }
     }
 
-    for (const name in schema.$_terms) {
+    for (const name of Object.keys(schema.$_terms)) {
         if (name[0] === '_') {
             continue;
         }
@@ -251,7 +251,7 @@ internals.scan = function (item, source, options, _path, _key) {
         return result;
     }
 
-    for (const key in item) {
+    for (const key of Object.keys(item)) {
         if (key[0] === '_') {
             continue;
         }

package/lib/types/alternatives.js

@@ -181,6 +181,9 @@ module.exports = Any.extend({
             if (matchMode === 'one') {
                 res.oneOf = matches;
             }
+            else if (matchMode === 'all') {
+                res.allOf = matches;
+            }
             else {
                 res.anyOf = matches;
             }

package/lib/types/any.js

@@ -112,7 +112,7 @@ module.exports = Base.extend({
 
         build(obj, desc) {
 
-            for (const key in desc) {
+            for (const key of Object.keys(desc)) {
                 const values = desc[key];
 
                 if (['examples', 'externals', 'metas', 'notes', 'tags'].includes(key)) {

package/lib/types/array.js

@@ -93,7 +93,7 @@ module.exports = Any.extend({
 
             if (ordered.length) {
                 res.unevaluatedItems = items;
-                res.minItems = ordered.length;
+                internals.setOrderedMinItems(res, ordered);
             }
             else {
                 res.items = items;
@@ -103,7 +103,7 @@ module.exports = Any.extend({
             // No additional items allowed beyond the ordered ones
 
             res.unevaluatedItems = false;
-            res.minItems = ordered.length;
+            internals.setOrderedMinItems(res, ordered);
             res.maxItems = ordered.length;
         }
 
@@ -111,7 +111,9 @@ module.exports = Any.extend({
 
         const contains = [];
         for (const rule of schema._rules) {
-            if (rule.name === 'has') {
+            if (rule.name === 'has' &&
+                !rule.args.schema._refs.refs.length) {
+
                 contains.push(rule.args.schema.$_jsonSchema(mode, options));
             }
         }
@@ -660,7 +662,9 @@ module.exports = Any.extend({
             },
             jsonSchema(rule, res) {
 
-                res.uniqueItems = true;
+                if (!rule.args.comparator) {
+                    res.uniqueItems = true;
+                }
 
                 return res;
             },
@@ -768,6 +772,29 @@ module.exports = Any.extend({
 
 // Helpers
 
+internals.setOrderedMinItems = function (res, ordered) {
+
+    // Ordered items are optional by default; the array only needs to reach the
+    // last explicitly required position.
+    const minItems = internals.orderedMinItems(ordered);
+    if (minItems) {
+        res.minItems = minItems;
+    }
+};
+
+
+internals.orderedMinItems = function (ordered) {
+
+    for (let i = ordered.length - 1; i >= 0; --i) {
+        if (ordered[i]._flags.presence === 'required') {
+            return i + 1;
+        }
+    }
+
+    return 0;
+};
+
+
 internals.fillMissedErrors = function (schema, errors, requireds, value, state, prefs) {
 
     const knownMisses = [];

package/lib/types/keys.js

@@ -61,6 +61,11 @@ module.exports = Any.extend({
             for (const child of schema.$_terms.keys) {
                 const jsonSchema = child.schema.$_jsonSchema(mode, options);
                 res.properties[child.key] = jsonSchema;
+
+                if (child.schema._flags.id) {
+                    options.$defs[child.schema._flags.id] = jsonSchema;
+                }
+
                 if (child.schema._flags.presence === 'required' ||
                     (mode === 'output' && child.schema._flags.default !== undefined)) {
 
@@ -320,7 +325,7 @@ module.exports = Any.extend({
                 }
                 else {
                     obj.$_terms.keys = obj.$_terms.keys ? obj.$_terms.keys.filter((child) => !schema.hasOwnProperty(child.key)) : new internals.Keys();
-                    for (const key in schema) {
+                    for (const key of Object.keys(schema)) {
                         Common.tryWithPath(() => obj.$_terms.keys.push({ key, schema: this.$_compile(schema[key]) }), key);
                     }
                 }
@@ -650,6 +655,7 @@ module.exports = Any.extend({
         'object.regex': '{{#label}} must be a RegExp object',
         'object.rename.multiple': '{{#label}} cannot rename {{:#from}} because multiple renames are disabled and another key was already renamed to {{:#to}}',
         'object.rename.override': '{{#label}} cannot rename {{:#from}} because override is disabled and target {{:#to}} exists',
+        'object.rename.proto': '{{#label}} cannot rename {{:#from}} because target {{:#to}} is a reserved key',
         'object.schema': '{{#label}} must be a Joi schema of {{#type}} type',
         'object.unknown': '{{#label}} is not allowed',
         'object.with': '{{:#mainWithLabel}} missing required peer {{:#peerWithLabel}}',
@@ -670,8 +676,15 @@ internals.clone = function (value, prefs) {
             return Clone(value, { shallow: true });
         }
 
-        const clone = Object.create(Object.getPrototypeOf(value));
+        const proto = Object.getPrototypeOf(value);
+        const clone = Object.create(proto);
         Object.assign(clone, value);
+
+        // Restore the prototype in case of pre-existing prototype pollution
+        if (Object.getPrototypeOf(clone) !== proto) {
+            Object.setPrototypeOf(clone, proto);
+        }
+
         return clone;
     }
 
@@ -920,7 +933,7 @@ internals.rename = function (schema, value, state, prefs, errors) {
             }
         }
         else {
-            for (const from in value) {
+            for (const from of Object.keys(value)) {
                 if (value[from] === undefined &&
                     rename.options.ignoreUndefined) {
 
@@ -970,6 +983,15 @@ internals.rename = function (schema, value, state, prefs, errors) {
                 }
             }
 
+            if (to === '__proto__') {
+                errors.push(schema.$_createError('object.rename.proto', value, { from, to, pattern }, state, prefs));
+                if (prefs.abortEarly) {
+                    return false;
+                }
+
+                continue;
+            }
+
             if (value[from] === undefined) {
                 delete value[to];
             }

package/lib/types/string.js

@@ -313,7 +313,7 @@ module.exports = Any.extend({
         email: {
             method(options = {}) {
 
-                Common.assertOptions(options, ['allowFullyQualified', 'allowUnicode', 'ignoreLength', 'maxDomainSegments', 'minDomainSegments', 'multiple', 'separator', 'tlds']);
+                Common.assertOptions(options, ['allowFullyQualified', 'allowUnicode', 'allowUnderscore', 'ignoreLength', 'maxDomainSegments', 'minDomainSegments', 'multiple', 'separator', 'tlds']);
                 assert(options.multiple === undefined || typeof options.multiple === 'boolean', 'multiple option must be an boolean');
 
                 const address = internals.addressOptions(options);
@@ -693,7 +693,19 @@ module.exports = Any.extend({
             },
             jsonSchema(rule, res) {
 
-                res.pattern = rule.args.regex.source;
+                const pattern = rule.args.regex.source;
+
+                if (res.allOf) {
+                    res.allOf.push({ pattern });
+                }
+                else if (res.pattern !== undefined) {
+                    res.allOf = [{ pattern: res.pattern }, { pattern }];
+                    delete res.pattern;
+                }
+                else {
+                    res.pattern = pattern;
+                }
+
                 return res;
             },
             args: ['regex', 'options'],
@@ -965,8 +977,8 @@ internals.isoDate = function (value) {
         return null;
     }
 
-    if (/.*T.*[+-]\d\d$/.test(value)) {             // Add missing trailing zeros to timeshift
-        value += '00';
+    if (/T.*[+-]\d\d$/.test(value)) {                // Add missing separator and trailing zeros to timeshift
+        value += ':00';
     }
 
     const date = new Date(value);

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "joi",
     "description": "Object schema validation",
-    "version": "18.2.1",
+    "version": "18.2.6",
     "repository": {
         "url": "git://github.com/hapijs/joi.git",
         "type": "git"
@@ -37,6 +37,7 @@
         "@hapi/lab": "^26.0.0",
         "@types/node": "^20.17.47",
         "ajv": "^8.18.0",
+        "ajv-formats": "^3.0.1",
         "typescript": "^5.8.3"
     },
     "scripts": {