z-schema 12.0.0 → 12.0.2

package/README.md

@@ -4,7 +4,7 @@ Fast, lightweight JSON Schema validator for Node.js and browsers with **full sup
 
 [![NPM](https://nodei.co/npm/z-schema.png?downloads=true&downloadRank=true)](https://www.npmjs.com/package/z-schema)
 
-[![Coverage Status](https://coveralls.io/repos/github/zaggino/z-schema/badge.svg?branch=main)](https://coveralls.io/github/zaggino/z-schema?branch=main)
+[![Coverage 91%](https://img.shields.io/badge/coverage-91%25-brightgreen)](docs/test-coverage.md)
 
 ## Install
 
@@ -330,6 +330,13 @@ Big thanks to:
                     <sub><b>Geraint</b></sub>
                 </a>
             </td>
+            <td align="center">
+                <a href="https://github.com/lirenhe">
+                    <img src="https://avatars.githubusercontent.com/u/9100546?v=4" width="100;" alt="lirenhe"/>
+                    <br />
+                    <sub><b>Renhe Li</b></sub>
+                </a>
+            </td>
             <td align="center">
                 <a href="https://github.com/dgerber">
                     <img src="https://avatars.githubusercontent.com/u/393344?v=4" width="100;" alt="dgerber"/>
@@ -358,6 +365,8 @@ Big thanks to:
                     <sub><b>barrtender</b></sub>
                 </a>
             </td>
+		</tr>
+		<tr>
             <td align="center">
                 <a href="https://github.com/RomanHotsiy">
                     <img src="https://avatars.githubusercontent.com/u/3975738?v=4" width="100;" alt="RomanHotsiy"/>
@@ -365,8 +374,6 @@ Big thanks to:
                     <sub><b>Roman Hotsiy</b></sub>
                 </a>
             </td>
-		</tr>
-		<tr>
             <td align="center">
                 <a href="https://github.com/sauvainr">
                     <img src="https://avatars.githubusercontent.com/u/1715747?v=4" width="100;" alt="sauvainr"/>
@@ -402,6 +409,8 @@ Big thanks to:
                     <sub><b>José F. Romaniello</b></sub>
                 </a>
             </td>
+		</tr>
+		<tr>
             <td align="center">
                 <a href="https://github.com/KEIII">
                     <img src="https://avatars.githubusercontent.com/u/1167833?v=4" width="100;" alt="KEIII"/>
@@ -409,8 +418,6 @@ Big thanks to:
                     <sub><b>Ivan Kasenkov</b></sub>
                 </a>
             </td>
-		</tr>
-		<tr>
             <td align="center">
                 <a href="https://github.com/HanOterLin">
                     <img src="https://avatars.githubusercontent.com/u/21137108?v=4" width="100;" alt="HanOterLin"/>

package/bin/z-schema

@@ -104,7 +104,34 @@ function validateWithAutomaticDownloads(filePath, data, schema, callback) {
         var urlString = 'request: ' + url + ' - ';
 
         if (url.match(/^https?:/)) {
-          request(url, function (response) {
+          var parsedUrl;
+          try {
+            parsedUrl = new URL(url);
+          } catch (_e) {
+            console.error('Invalid URL: ' + url);
+            process.exit(1);
+          }
+          // Guard against SSRF: only allow https and reject private/internal hostnames (CWE-918)
+          if (parsedUrl.protocol !== 'https:') {
+            console.error('Only HTTPS URLs are allowed for remote references: ' + url);
+            process.exit(1);
+          }
+          var hostname = parsedUrl.hostname;
+          if (
+            hostname === 'localhost' ||
+            hostname === '127.0.0.1' ||
+            hostname === '::1' ||
+            hostname === '0.0.0.0' ||
+            hostname.endsWith('.local') ||
+            hostname.startsWith('10.') ||
+            hostname.startsWith('192.168.') ||
+            /^172\.(1[6-9]|2\d|3[01])\./.test(hostname) ||
+            hostname.startsWith('169.254.')
+          ) {
+            console.error('Requests to private/internal addresses are not allowed: ' + url);
+            process.exit(1);
+          }
+          request(parsedUrl, function (response) {
             var body = '';
             response.on('data', function (chunk) {
               body += chunk;

package/cjs/index.d.ts

@@ -231,6 +231,14 @@ declare class ZSchemaBase {
     validateOptions: ValidateOptions;
     options: ZSchemaOptions;
     constructor(options: ZSchemaOptions | undefined, token: symbol);
+    /**
+     * Internal recursive JSON validation — delegates to the `validate` function
+     * in `json-validation.ts`. Exposed as a method so that per-keyword validator
+     * modules (array, combinators, object) can call back into the core validator
+     * via `this` without importing `json-validation.ts` directly (which would
+     * create a circular dependency).
+     */
+    _jsonValidate(report: Report, schema: boolean | JsonSchemaInternal, json: unknown): boolean;
     getDefaultSchemaId(): string;
     _validate(json: unknown, schema: JsonSchema | string, options: ValidateOptions, callback: ValidateCallback): void;
     _validate(json: unknown, schema: JsonSchema | string, callback: ValidateCallback): void;