z-schema 12.0.0 → 12.0.2

package/cjs/index.js

@@ -15,6 +15,26 @@ const getRemotePath = (uri) => {
 };
 const isAbsoluteUri = (uri) => /^[a-zA-Z][a-zA-Z\d+.-]*:/.test(uri);
 
+/**
+ * Default maximum recursion depth for deeply nested schema/data traversal.
+ * Used as the default for {@link ZSchemaOptions.maxRecursionDepth} and
+ * internal helpers like `deepClone` and `collectIds`.
+ */
+const DEFAULT_MAX_RECURSION_DEPTH = 100;
+/**
+ * Maximum allowed value for {@link ZSchemaOptions.asyncTimeout} in milliseconds.
+ * Values exceeding this limit are clamped during option normalization to
+ * prevent resource exhaustion (CWE-400).
+ */
+const MAX_ASYNC_TIMEOUT = 60_000;
+/**
+ * Maximum allowed length for a JSON Schema `pattern` regular expression string.
+ * Patterns exceeding this limit are rejected by {@link compileSchemaRegex} to
+ * mitigate Regular Expression Denial-of-Service (CWE-1333) and regex injection
+ * (CWE-95).
+ */
+const MAX_SCHEMA_REGEX_LENGTH = 10_000;
+
 const whatIs = (what) => {
     if (typeof what === 'object') {
         if (what === null) {
@@ -48,177 +68,6 @@ function isInteger(value) {
     return typeof value === 'number' && Number.isFinite(value) && value % 1 === 0;
 }
 
-const CURRENT_DEFAULT_SCHEMA_VERSION = 'draft2020-12';
-const VERSION_SCHEMA_URL_MAPPING = {
-    'draft-04': 'http://json-schema.org/draft-04/schema#',
-    'draft-06': 'http://json-schema.org/draft-06/schema#',
-    'draft-07': 'http://json-schema.org/draft-07/schema#',
-    'draft2019-09': 'https://json-schema.org/draft/2019-09/schema',
-    'draft2020-12': 'https://json-schema.org/draft/2020-12/schema',
-};
-
-function copyProp(from, to, key, fn) {
-    if (Object.hasOwn(from, key)) {
-        Object.defineProperty(to, key, {
-            value: fn ? fn(from[key]) : from[key],
-            enumerable: true,
-            writable: true,
-            configurable: true,
-        });
-    }
-}
-
-const shallowClone = (src) => {
-    if (src == null || typeof src !== 'object') {
-        return src;
-    }
-    let res;
-    if (Array.isArray(src)) {
-        res = [];
-        for (let i = 0; i < src.length; i++) {
-            res[i] = src[i];
-        }
-    }
-    else {
-        res = {};
-        const keys = Object.keys(src).sort();
-        for (const key of keys) {
-            copyProp(src, res, key);
-        }
-    }
-    return res;
-};
-const deepClone = (src, maxDepth = DEFAULT_MAX_RECURSION_DEPTH) => {
-    let vidx = 0;
-    const visited = new Map();
-    const cloned = [];
-    const cloneDeepInner = (src, _depth) => {
-        if (typeof src !== 'object' || src === null) {
-            return src;
-        }
-        if (_depth >= maxDepth) {
-            throw new Error(`Maximum recursion depth (${maxDepth}) exceeded in deepClone. ` +
-                'If your schema or data is deeply nested and valid, increase the maxRecursionDepth option.');
-        }
-        let res;
-        const cidx = visited.get(src);
-        if (cidx !== undefined) {
-            return cloned[cidx];
-        }
-        visited.set(src, vidx++);
-        if (Array.isArray(src)) {
-            res = [];
-            cloned.push(res);
-            for (let i = 0; i < src.length; i++) {
-                res[i] = cloneDeepInner(src[i], _depth + 1);
-            }
-        }
-        else {
-            res = {};
-            cloned.push(res);
-            const keys = Object.keys(src).sort();
-            for (const key of keys) {
-                copyProp(src, res, key, (v) => cloneDeepInner(v, _depth + 1));
-            }
-        }
-        return res;
-    };
-    return cloneDeepInner(src, 0);
-};
-
-const DEFAULT_MAX_RECURSION_DEPTH = 100;
-const defaultOptions = {
-    // default version to validate against
-    version: CURRENT_DEFAULT_SCHEMA_VERSION,
-    // default timeout for all async tasks
-    asyncTimeout: 2000,
-    // force additionalProperties and additionalItems to be defined on "object" and "array" types
-    forceAdditional: false,
-    // assume additionalProperties and additionalItems are defined as "false" where appropriate
-    assumeAdditional: false,
-    // do case insensitive comparison for enums
-    enumCaseInsensitiveComparison: false,
-    // force items to be defined on "array" types
-    forceItems: false,
-    // force minItems to be defined on "array" types
-    forceMinItems: false,
-    // force maxItems to be defined on "array" types
-    forceMaxItems: false,
-    // force minLength to be defined on "string" types
-    forceMinLength: false,
-    // force maxLength to be defined on "string" types
-    forceMaxLength: false,
-    // force properties or patternProperties to be defined on "object" types
-    forceProperties: false,
-    // ignore references that cannot be resolved (remote schemas)
-    ignoreUnresolvableReferences: false,
-    // disallow usage of keywords that this validator can't handle
-    noExtraKeywords: false,
-    // disallow usage of schema's without "type" defined
-    noTypeless: false,
-    // disallow zero length strings in validated objects
-    noEmptyStrings: false,
-    // disallow zero length arrays in validated objects
-    noEmptyArrays: false,
-    // forces "uri" format to be in fully rfc3986 compliant
-    strictUris: false,
-    // turn on some of the above
-    strictMode: false,
-    // report error paths as an array of path segments to get to the offending node
-    reportPathAsArray: false,
-    // stop validation as soon as an error is found
-    breakOnFirstError: false,
-    // check if schema follows best practices and common sense
-    pedanticCheck: false,
-    // ignore unknown formats (do not report them as an error)
-    ignoreUnknownFormats: false,
-    // control format assertion behavior:
-    //   true  - respect vocabulary: for draft 2019-09/2020-12, check meta-schema $vocabulary
-    //           to determine if format is assertion or annotation-only
-    //   false - format is always annotation-only (never asserts)
-    //   null  - legacy behavior: always assert format validation
-    formatAssertions: null,
-    // function to be called on every schema
-    customValidator: null,
-    // maximum recursion depth for deeply nested schema/data traversal (prevents stack overflow)
-    maxRecursionDepth: DEFAULT_MAX_RECURSION_DEPTH,
-};
-const normalizeOptions = (options) => {
-    let normalized;
-    // options
-    if (typeof options === 'object') {
-        let keys = Object.keys(options);
-        // check that the options are correctly configured
-        for (const key of keys) {
-            if (defaultOptions[key] === undefined) {
-                throw new Error('Unexpected option passed to constructor: ' + key);
-            }
-        }
-        // copy the default options into passed options
-        keys = Object.keys(defaultOptions);
-        for (const key of keys) {
-            if (options[key] === undefined) {
-                options[key] = shallowClone(defaultOptions[key]);
-            }
-        }
-        normalized = options;
-    }
-    else {
-        normalized = shallowClone(defaultOptions);
-    }
-    if (normalized.strictMode === true) {
-        normalized.forceAdditional = true;
-        normalized.forceItems = true;
-        normalized.forceMaxLength = true;
-        normalized.forceProperties = true;
-        normalized.noExtraKeywords = true;
-        normalized.noTypeless = true;
-        normalized.noEmptyStrings = true;
-        normalized.noEmptyArrays = true;
-    }
-    return normalized;
-};
-
 /**
  * Keywords whose values are not JSON Schema sub-schemas and must not be
  * traversed during schema walking (id collection, reference collection, etc.).
@@ -374,6 +223,75 @@ function getValidateError({ message, details }) {
     return new ValidateError(message || '', details);
 }
 
+function copyProp(from, to, key, fn) {
+    if (Object.hasOwn(from, key)) {
+        Object.defineProperty(to, key, {
+            value: fn ? fn(from[key]) : from[key],
+            enumerable: true,
+            writable: true,
+            configurable: true,
+        });
+    }
+}
+
+const shallowClone = (src) => {
+    if (src == null || typeof src !== 'object') {
+        return src;
+    }
+    let res;
+    if (Array.isArray(src)) {
+        res = [];
+        for (let i = 0; i < src.length; i++) {
+            res[i] = src[i];
+        }
+    }
+    else {
+        res = {};
+        const keys = Object.keys(src).sort();
+        for (const key of keys) {
+            copyProp(src, res, key);
+        }
+    }
+    return res;
+};
+const deepClone = (src, maxDepth = DEFAULT_MAX_RECURSION_DEPTH) => {
+    let vidx = 0;
+    const visited = new Map();
+    const cloned = [];
+    const cloneDeepInner = (src, _depth) => {
+        if (typeof src !== 'object' || src === null) {
+            return src;
+        }
+        if (_depth >= maxDepth) {
+            throw new Error(`Maximum recursion depth (${maxDepth}) exceeded in deepClone. ` +
+                'If your schema or data is deeply nested and valid, increase the maxRecursionDepth option.');
+        }
+        let res;
+        const cidx = visited.get(src);
+        if (cidx !== undefined) {
+            return cloned[cidx];
+        }
+        visited.set(src, vidx++);
+        if (Array.isArray(src)) {
+            res = [];
+            cloned.push(res);
+            for (let i = 0; i < src.length; i++) {
+                res[i] = cloneDeepInner(src[i], _depth + 1);
+            }
+        }
+        else {
+            res = {};
+            cloned.push(res);
+            const keys = Object.keys(src).sort();
+            for (const key of keys) {
+                copyProp(src, res, key, (v) => cloneDeepInner(v, _depth + 1));
+            }
+        }
+        return res;
+    };
+    return cloneDeepInner(src, 0);
+};
+
 const areEqual = (json1, json2, options, _depth = 0) => {
     const caseInsensitiveComparison = options?.caseInsensitiveComparison || false;
     const maxDepth = options?.maxDepth ?? DEFAULT_MAX_RECURSION_DEPTH;
@@ -446,6 +364,7 @@ const get = (obj, path) => {
 const jsonSymbol = Symbol.for('z-schema/json');
 const schemaSymbol = Symbol.for('z-schema/schema');
 
+const ASYNC_TIMEOUT_POLL_MS = 10;
 class Report {
     asyncTasks = [];
     commonErrorMessage;
@@ -519,7 +438,8 @@ class Report {
         return this.parentReport.getAncestor(id);
     }
     processAsyncTasks(timeout, callback) {
-        const validationTimeout = timeout || 2000;
+        const validationTimeout = Math.min(Math.max(timeout || 2000, 0), MAX_ASYNC_TIMEOUT);
+        const timeoutAt = Date.now() + validationTimeout;
         let tasksCount = this.asyncTasks.length;
         let timedOut = false;
         const finish = () => {
@@ -548,13 +468,19 @@ class Report {
             const respondCallback = respond(processFn);
             fn(...fnArgs, respondCallback);
         }
-        setTimeout(() => {
-            if (tasksCount > 0) {
+        const checkTimeout = () => {
+            if (timedOut || tasksCount <= 0) {
+                return;
+            }
+            if (Date.now() >= timeoutAt) {
                 timedOut = true;
                 this.addError('ASYNC_TIMEOUT', [tasksCount, validationTimeout]);
                 callback(getValidateError({ details: this.errors }), false);
+                return;
             }
-        }, validationTimeout);
+            setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
+        };
+        setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
     }
     getPath(returnPathAsString) {
         let path = [];
@@ -697,6 +623,122 @@ class Report {
     }
 }
 
+const CURRENT_DEFAULT_SCHEMA_VERSION = 'draft2020-12';
+const VERSION_SCHEMA_URL_MAPPING = {
+    'draft-04': 'http://json-schema.org/draft-04/schema#',
+    'draft-06': 'http://json-schema.org/draft-06/schema#',
+    'draft-07': 'http://json-schema.org/draft-07/schema#',
+    'draft2019-09': 'https://json-schema.org/draft/2019-09/schema',
+    'draft2020-12': 'https://json-schema.org/draft/2020-12/schema',
+};
+
+const defaultOptions = {
+    // default version to validate against
+    version: CURRENT_DEFAULT_SCHEMA_VERSION,
+    // default timeout for all async tasks
+    asyncTimeout: 2000,
+    // force additionalProperties and additionalItems to be defined on "object" and "array" types
+    forceAdditional: false,
+    // assume additionalProperties and additionalItems are defined as "false" where appropriate
+    assumeAdditional: false,
+    // do case insensitive comparison for enums
+    enumCaseInsensitiveComparison: false,
+    // force items to be defined on "array" types
+    forceItems: false,
+    // force minItems to be defined on "array" types
+    forceMinItems: false,
+    // force maxItems to be defined on "array" types
+    forceMaxItems: false,
+    // force minLength to be defined on "string" types
+    forceMinLength: false,
+    // force maxLength to be defined on "string" types
+    forceMaxLength: false,
+    // force properties or patternProperties to be defined on "object" types
+    forceProperties: false,
+    // ignore references that cannot be resolved (remote schemas)
+    ignoreUnresolvableReferences: false,
+    // disallow usage of keywords that this validator can't handle
+    noExtraKeywords: false,
+    // disallow usage of schema's without "type" defined
+    noTypeless: false,
+    // disallow zero length strings in validated objects
+    noEmptyStrings: false,
+    // disallow zero length arrays in validated objects
+    noEmptyArrays: false,
+    // forces "uri" format to be in fully rfc3986 compliant
+    strictUris: false,
+    // turn on some of the above
+    strictMode: false,
+    // report error paths as an array of path segments to get to the offending node
+    reportPathAsArray: false,
+    // stop validation as soon as an error is found
+    breakOnFirstError: false,
+    // check if schema follows best practices and common sense
+    pedanticCheck: false,
+    // ignore unknown formats (do not report them as an error)
+    ignoreUnknownFormats: false,
+    // control format assertion behavior:
+    //   true  - respect vocabulary: for draft 2019-09/2020-12, check meta-schema $vocabulary
+    //           to determine if format is assertion or annotation-only
+    //   false - format is always annotation-only (never asserts)
+    //   null  - legacy behavior: always assert format validation
+    formatAssertions: null,
+    // function to be called on every schema
+    customValidator: null,
+    // maximum recursion depth for deeply nested schema/data traversal (prevents stack overflow)
+    maxRecursionDepth: DEFAULT_MAX_RECURSION_DEPTH,
+};
+const normalizeOptions = (options) => {
+    let normalized;
+    // options
+    if (typeof options === 'object') {
+        let keys = Object.keys(options);
+        // check that the options are correctly configured
+        for (const key of keys) {
+            if (defaultOptions[key] === undefined) {
+                throw new Error('Unexpected option passed to constructor: ' + key);
+            }
+        }
+        // copy the default options into passed options
+        keys = Object.keys(defaultOptions);
+        for (const key of keys) {
+            if (options[key] === undefined) {
+                options[key] = shallowClone(defaultOptions[key]);
+            }
+        }
+        normalized = options;
+    }
+    else {
+        normalized = shallowClone(defaultOptions);
+    }
+    // Clamp asyncTimeout to prevent resource exhaustion (CWE-400)
+    if (normalized.asyncTimeout != null) {
+        normalized.asyncTimeout = Math.min(Math.max(normalized.asyncTimeout, 0), MAX_ASYNC_TIMEOUT);
+    }
+    if (normalized.strictMode === true) {
+        normalized.forceAdditional = true;
+        normalized.forceItems = true;
+        normalized.forceMaxLength = true;
+        normalized.forceProperties = true;
+        normalized.noExtraKeywords = true;
+        normalized.noTypeless = true;
+        normalized.noEmptyStrings = true;
+        normalized.noEmptyArrays = true;
+    }
+    return normalized;
+};
+
+// Normalize a URI into a cache key, rejecting keys that could pollute Object.prototype.
+function getSafeRemotePath(uri) {
+    const remotePath = getRemotePath(uri);
+    if (!remotePath) {
+        return undefined;
+    }
+    if (remotePath === '__proto__' || remotePath === 'constructor' || remotePath === 'prototype') {
+        return undefined;
+    }
+    return remotePath;
+}
 const getEffectiveId = (schema) => {
     let id = getId(schema);
     if ((!id || !isAbsoluteUri(id)) && typeof schema.id === 'string' && isAbsoluteUri(schema.id)) {
@@ -727,31 +769,31 @@ function prepareRemoteSchema(schema, uri, validationOptions, maxCloneDepth) {
 }
 class SchemaCache {
     validator;
-    static global_cache = {};
-    cache = {};
+    static global_cache = Object.create(null);
+    cache = Object.create(null);
     constructor(validator) {
         this.validator = validator;
     }
     static cacheSchemaByUri(uri, schema) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             this.global_cache[remotePath] = schema;
         }
     }
     cacheSchemaByUri(uri, schema) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             this.cache[remotePath] = schema;
         }
     }
     removeFromCacheByUri(uri) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             delete this.cache[remotePath];
         }
     }
     checkCacheForUri(uri) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         return remotePath ? this.cache[remotePath] != null : false;
     }
     getSchema(report, refOrSchema) {
@@ -766,6 +808,9 @@ class SchemaCache {
         return deepClone(refOrSchema, this.validator.options.maxRecursionDepth);
     }
     fromCache(path) {
+        if (path === '__proto__' || path === 'constructor' || path === 'prototype') {
+            return undefined;
+        }
         let found = this.cache[path];
         if (found) {
             return found;
@@ -797,7 +842,7 @@ class SchemaCache {
                 }
             }
         }
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         const queryPath = getQueryPath(uri);
         let result;
         let resolvedFromAncestor = false;
@@ -4331,19 +4376,55 @@ const uriTemplateValidator = (uri) => {
     }
     return !inExpression;
 };
+const hasValidTildeEscapes = (segment) => {
+    for (let i = 0; i < segment.length; i++) {
+        if (segment[i] === '~') {
+            const next = segment[i + 1];
+            if (next !== '0' && next !== '1') {
+                return false;
+            }
+            i++; // skip the escape character
+        }
+    }
+    return true;
+};
 const jsonPointerValidator = (pointer) => {
     if (typeof pointer !== 'string')
         return true;
     // JSON Pointer: empty, or a sequence of '/'-prefixed reference tokens.
     // In each token, '~' must be escaped as '~0' or '~1'.
-    return pointer === '' || /^(?:\/(?:[^~]|~0|~1)*)+$/.test(pointer);
+    if (pointer === '')
+        return true;
+    if (!/^(?:\/[^/]*)+$/.test(pointer))
+        return false;
+    const tokens = pointer.split('/').slice(1); // first element is empty before leading '/'
+    for (const token of tokens) {
+        if (!hasValidTildeEscapes(token))
+            return false;
+    }
+    return true;
 };
 const relativeJsonPointerValidator = (pointer) => {
     if (typeof pointer !== 'string')
         return true;
     // Relative JSON Pointer: non-negative integer prefix (no leading zeros unless zero),
     // followed by either '#', a JSON Pointer, or nothing.
-    return /^(?:0|[1-9]\d*)(?:#|(?:\/(?:[^~]|~0|~1)*)+)?$/.test(pointer);
+    const match = pointer.match(/^(0|[1-9]\d*)(.*)$/);
+    if (!match)
+        return false;
+    const suffix = match[2];
+    if (suffix === '' || suffix === '#')
+        return true;
+    if (!suffix.startsWith('/'))
+        return false;
+    if (!/^(?:\/[^/]*)+$/.test(suffix))
+        return false;
+    const tokens = suffix.split('/').slice(1);
+    for (const token of tokens) {
+        if (!hasValidTildeEscapes(token))
+            return false;
+    }
+    return true;
 };
 const timeValidator = (time) => {
     if (typeof time !== 'string')
@@ -4447,6 +4528,15 @@ function getRegisteredFormats() {
 // Shared regex compilation helper for JSON Schema patterns
 // Returns { ok: true, value: RegExp } or { ok: false, error: { pattern, message } }
 function compileSchemaRegex(pattern) {
+    if (pattern.length > MAX_SCHEMA_REGEX_LENGTH) {
+        return {
+            ok: false,
+            error: {
+                pattern,
+                message: `Pattern length ${pattern.length} exceeds maximum allowed length of ${MAX_SCHEMA_REGEX_LENGTH}`,
+            },
+        };
+    }
     const unicodePropertyEscape = /\\[pP]{/;
     const nonBmpCharacter = /[\u{10000}-\u{10FFFF}]/u;
     const surrogatePairEscape = /\\uD[89AB][0-9A-Fa-f]{2}\\uD[CDEF][0-9A-Fa-f]{2}/;
@@ -4455,6 +4545,7 @@ function compileSchemaRegex(pattern) {
     if (needsUnicode) {
         // Try compiling with 'u' flag only
         try {
+            // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
             const re = new RegExp(pattern, 'u');
             return { ok: true, value: re };
         }
@@ -4470,6 +4561,7 @@ function compileSchemaRegex(pattern) {
     }
     else {
         try {
+            // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
             const re = new RegExp(pattern);
             return { ok: true, value: re };
         }
@@ -4789,7 +4881,7 @@ function containsValidator(report, schema, json) {
     for (let idx = 0; idx < json.length; idx++) {
         const subReport = new Report_(report);
         subReports.push(subReport);
-        validate.call(this, subReport, containsSchema, json[idx]);
+        this._jsonValidate(subReport, containsSchema, json[idx]);
         cacheValidationResult(report, containsSchema, json[idx], subReport.errors.length === 0);
     }
     const addContainsErrorIfNeeded = () => {
@@ -4822,7 +4914,7 @@ function minContainsValidator() { }
 function allOfValidator(report, schema, json) {
     // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.5.3.2
     for (let i = 0; i < schema.allOf.length; i++) {
-        const validateResult = validate.call(this, report, schema.allOf[i], json);
+        const validateResult = this._jsonValidate(report, schema.allOf[i], json);
         if (this.options.breakOnFirstError && validateResult === false) {
             break;
         }
@@ -4837,7 +4929,7 @@ function anyOfValidator(report, schema, json) {
     for (let i = 0; i < schema.anyOf.length; i++) {
         const subReport = new Report(report);
         subReports.push(subReport);
-        validate.call(this, subReport, schema.anyOf[i], json);
+        this._jsonValidate(subReport, schema.anyOf[i], json);
         cacheValidationResult(report, schema.anyOf[i], json, subReport.errors.length === 0);
     }
     // Aggregate async tasks and decide when ready
@@ -4863,7 +4955,7 @@ function oneOfValidator(report, schema, json) {
     for (let i = 0; i < schema.oneOf.length; i++) {
         const subReport = new Report(report);
         subReports.push(subReport);
-        validate.call(this, subReport, schema.oneOf[i], json);
+        this._jsonValidate(subReport, schema.oneOf[i], json);
         cacheValidationResult(report, schema.oneOf[i], json, subReport.errors.length === 0);
     }
     // Aggregate async tasks and decide when ready
@@ -4888,7 +4980,7 @@ function oneOfValidator(report, schema, json) {
 function notValidator(report, schema, json) {
     // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.5.6.2
     const subReport = new Report(report);
-    if (validate.call(this, subReport, schema.not, json) === true) {
+    if (this._jsonValidate(subReport, schema.not, json) === true) {
         report.addError('NOT_PASSED', undefined, undefined, schema, 'not');
     }
 }
@@ -4906,13 +4998,13 @@ function ifValidator(report, schema, json) {
         return;
     }
     const conditionReport = new Report(report);
-    validate.call(this, conditionReport, conditionSchema, json);
+    this._jsonValidate(conditionReport, conditionSchema, json);
     cacheValidationResult(report, conditionSchema, json, conditionReport.errors.length === 0);
     const branchSchema = conditionReport.errors.length === 0 ? thenSchema : elseSchema;
     if (branchSchema === undefined) {
         return;
     }
-    validate.call(this, report, branchSchema, json);
+    this._jsonValidate(report, branchSchema, json);
 }
 function thenValidator() {
     // handled by if
@@ -5168,7 +5260,7 @@ function dependenciesValidator(report, schema, json) {
             }
             else {
                 // if dependency is a schema, validate against this schema
-                validate.call(this, report, dependencyDefinition, json);
+                this._jsonValidate(report, dependencyDefinition, json);
             }
         }
     }
@@ -5187,7 +5279,7 @@ function dependentSchemasValidator(report, schema, json) {
     for (const dependencyName of keys) {
         if (Object.hasOwn(json, dependencyName)) {
             const dependencySchema = schema.dependentSchemas[dependencyName];
-            validate.call(this, report, dependencySchema, json);
+            this._jsonValidate(report, dependencySchema, json);
         }
     }
 }
@@ -5240,7 +5332,7 @@ function propertyNamesValidator(report, schema, json) {
     for (const key of keys) {
         const subReport = new Report_(report);
         subReports.push(subReport);
-        validate.call(this, subReport, propertyNamesSchema, key);
+        this._jsonValidate(subReport, propertyNamesSchema, key);
     }
     const addPropertyNameErrors = () => {
         for (let idx = 0; idx < keys.length; idx++) {
@@ -5452,21 +5544,13 @@ function formatValidator(report, schema, json) {
             const result = formatValidatorFn.call(this, json);
             if (result instanceof Promise) {
                 // Promise-based async
-                const timeoutMs = this.options.asyncTimeout || 2000;
                 const promiseResult = result;
                 report.addAsyncTaskWithPath(async (callback) => {
                     try {
-                        const timeoutPromise = new Promise((_, reject) => {
-                            setTimeout(() => reject(new Error('Async timeout')), timeoutMs);
-                        });
-                        const resolved = await Promise.race([promiseResult, timeoutPromise]);
+                        const resolved = await promiseResult;
                         callback(resolved);
                     }
-                    catch (error) {
-                        if (error.message === 'Async timeout') {
-                            // Don't call callback, let global timeout handle it
-                            return;
-                        }
+                    catch (_error) {
                         callback(false);
                     }
                 }, [], function (resolvedResult) {
@@ -6314,6 +6398,21 @@ function setSchemaReader(schemaReader) {
     _schemaReader = schemaReader;
 }
 
+/** Safely assign a property on `obj`, refusing prototype-polluting keys. */
+function safeSetProperty(obj, key, value) {
+    const unsafeTargets = [
+        Object.prototype,
+        Function.prototype,
+        Array.prototype,
+    ];
+    if (unsafeTargets.includes(obj)) {
+        return;
+    }
+    /** Reject property names that could pollute Object.prototype (CWE-1321). */
+    if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
+        obj[key] = value;
+    }
+}
 const collectIds = (obj, maxDepth = DEFAULT_MAX_RECURSION_DEPTH) => {
     const ids = [];
     function walk(node, scope, _depth = 0) {
@@ -6479,7 +6578,8 @@ const resolveReference = (base, ref) => {
     }
     let baseDir = baseNoFrag;
     if (!baseDir.endsWith('/')) {
-        baseDir = baseDir.replace(/[^/]*$/, '');
+        const lastSlash = baseDir.lastIndexOf('/');
+        baseDir = lastSlash === -1 ? '' : baseDir.slice(0, lastSlash + 1);
     }
     return baseDir + ref;
 };
@@ -6550,8 +6650,14 @@ class SchemaCompiler {
                 this.collectAndCacheIds(schema);
             }
         }
+        const canMutateSchemaObject = schema !== Object.prototype &&
+            schema !== Function.prototype &&
+            schema !== Array.prototype;
         // if we have an id than it should be cached already (if this instance has compiled it)
-        if (schema.__$compiled && schema.id && this.validator.scache.checkCacheForUri(schema.id) === false) {
+        if (canMutateSchemaObject &&
+            schema.__$compiled &&
+            schema.id &&
+            this.validator.scache.checkCacheForUri(schema.id) === false) {
             schema.__$compiled = undefined;
         }
         // do not re-compile schemas
@@ -6559,7 +6665,7 @@ class SchemaCompiler {
             return true;
         }
         // v8 - if $schema is not present, set $schema to default
-        if (!schema.$schema && this.validator.options.version !== 'none') {
+        if (canMutateSchemaObject && !schema.$schema && this.validator.options.version !== 'none') {
             schema.$schema = this.validator.getDefaultSchemaId();
         }
         if (schema.id && typeof schema.id === 'string' && !options?.noCache) {
@@ -6574,7 +6680,9 @@ class SchemaCompiler {
         }
         // delete all __$missingReferences from previous compilation attempts
         const isValidExceptReferences = report.isValid();
-        delete schema.__$missingReferences;
+        if (canMutateSchemaObject) {
+            delete schema.__$missingReferences;
+        }
         // collect all references that need to be resolved - $ref and $schema
         const useRefObjectScope = this.validator.options.version === 'draft2019-09' || this.validator.options.version === 'draft2020-12';
         const refs = collectReferences(schema, undefined, undefined, undefined, { useRefObjectScope }, this.validator.options.maxRecursionDepth);
@@ -6622,17 +6730,17 @@ class SchemaCompiler {
                     report.addError('UNRESOLVABLE_REFERENCE', [refObj.ref]);
                     report.path = report.path.slice(0, -refObj.path.length);
                     // pusblish unresolved references out
-                    if (isValidExceptReferences) {
+                    if (isValidExceptReferences && canMutateSchemaObject) {
                         schema.__$missingReferences = schema.__$missingReferences || [];
                         schema.__$missingReferences.push(refObj);
                     }
                 }
             }
             // this might create circular references
-            refObj.obj[`__${refObj.key}Resolved`] = response;
+            safeSetProperty(refObj.obj, `__${refObj.key}Resolved`, response);
         }
         const isValid = report.isValid();
-        if (isValid) {
+        if (isValid && canMutateSchemaObject) {
             schema.__$compiled = true;
         }
         // else {
@@ -6665,7 +6773,7 @@ class SchemaCompiler {
                         const response = arr.find((x) => x.id === refObj.ref);
                         if (response) {
                             // this might create circular references
-                            refObj.obj[`__${refObj.key}Resolved`] = response;
+                            safeSetProperty(refObj.obj, `__${refObj.key}Resolved`, response);
                             // it's resolved now so delete it
                             sch.__$missingReferences.splice(idx2, 1);
                         }
@@ -7429,6 +7537,16 @@ class ZSchemaBase {
         this.sv = new SchemaValidator(this);
         this.options = normalizeOptions(options);
     }
+    /**
+     * Internal recursive JSON validation — delegates to the `validate` function
+     * in `json-validation.ts`. Exposed as a method so that per-keyword validator
+     * modules (array, combinators, object) can call back into the core validator
+     * via `this` without importing `json-validation.ts` directly (which would
+     * create a circular dependency).
+     */
+    _jsonValidate(report, schema, json) {
+        return validate.call(this, report, schema, json);
+    }
     getDefaultSchemaId() {
         return this.options.version && this.options.version !== 'none'
             ? VERSION_SCHEMA_URL_MAPPING[this.options.version]