z-schema 12.0.0 → 12.0.2

package/src/json-schema.ts

@@ -12,8 +12,8 @@ export const NON_SCHEMA_KEYWORDS = ['enum', 'const', 'default', 'examples'] as c
 
 /** Returns true if the key is an internal z-schema property (prefixed with `__$`). */
 export const isInternalKey = (key: string): boolean => key.startsWith('__$');
+import { DEFAULT_MAX_RECURSION_DEPTH } from './utils/constants.js';
 import { isObject } from './utils/what-is.js';
-import { DEFAULT_MAX_RECURSION_DEPTH } from './z-schema-options.js';
 
 /**
  * Properties present in ALL JSON Schema drafts (04 through 2020-12) with

package/src/report.ts

@@ -5,11 +5,14 @@ import type { ZSchemaOptions } from './z-schema-options.js';
 
 import { Errors, getValidateError } from './errors.js';
 import { shallowClone } from './utils/clone.js';
+import { MAX_ASYNC_TIMEOUT } from './utils/constants.js';
 import { get } from './utils/json.js';
 import { jsonSymbol, schemaSymbol } from './utils/symbols.js';
 import { isAbsoluteUri } from './utils/uri.js';
 import { isObject } from './utils/what-is.js';
 
+const ASYNC_TIMEOUT_POLL_MS = 10;
+
 export interface SchemaErrorDetail {
   /**
    * Example: "Expected type string but found type array"
@@ -158,7 +161,8 @@ export class Report {
   }
 
   processAsyncTasks(timeout: number | undefined, callback: ValidateCallback) {
-    const validationTimeout = timeout || 2000;
+    const validationTimeout = Math.min(Math.max(timeout || 2000, 0), MAX_ASYNC_TIMEOUT);
+    const timeoutAt = Date.now() + validationTimeout;
     let tasksCount = this.asyncTasks.length;
     let timedOut = false;
 
@@ -192,13 +196,19 @@ export class Report {
       fn(...fnArgs, respondCallback);
     }
 
-    setTimeout(() => {
-      if (tasksCount > 0) {
+    const checkTimeout = () => {
+      if (timedOut || tasksCount <= 0) {
+        return;
+      }
+      if (Date.now() >= timeoutAt) {
         timedOut = true;
         this.addError('ASYNC_TIMEOUT', [tasksCount, validationTimeout]);
         callback(getValidateError({ details: this.errors }), false);
+        return;
       }
-    }, validationTimeout);
+      setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
+    };
+    setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
   }
 
   getPath(returnPathAsString?: boolean) {

package/src/schema-cache.ts

@@ -12,6 +12,18 @@ import { normalizeOptions } from './z-schema-options.js';
 export type SchemaCacheStorage = Record<string, JsonSchemaInternal>;
 export type ReferenceSchemaCacheStorage = Array<[JsonSchemaInternal, JsonSchemaInternal]>;
 
+// Normalize a URI into a cache key, rejecting keys that could pollute Object.prototype.
+function getSafeRemotePath(uri: string): string | undefined {
+  const remotePath = getRemotePath(uri);
+  if (!remotePath) {
+    return undefined;
+  }
+  if (remotePath === '__proto__' || remotePath === 'constructor' || remotePath === 'prototype') {
+    return undefined;
+  }
+  return remotePath;
+}
+
 const getEffectiveId = (schema: JsonSchemaInternal): string | undefined => {
   let id = getId(schema);
   if ((!id || !isAbsoluteUri(id)) && typeof schema.id === 'string' && isAbsoluteUri(schema.id)) {
@@ -51,34 +63,34 @@ export function prepareRemoteSchema(
 }
 
 export class SchemaCache {
-  static global_cache: SchemaCacheStorage = {};
-  cache: SchemaCacheStorage = {};
+  static global_cache: SchemaCacheStorage = Object.create(null);
+  cache: SchemaCacheStorage = Object.create(null);
 
   constructor(private validator: ZSchemaBase) {}
 
   static cacheSchemaByUri(uri: string, schema: JsonSchemaInternal) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     if (remotePath) {
       this.global_cache[remotePath] = schema;
     }
   }
 
   cacheSchemaByUri(uri: string, schema: JsonSchemaInternal) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     if (remotePath) {
       this.cache[remotePath] = schema;
     }
   }
 
   removeFromCacheByUri(uri: string) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     if (remotePath) {
       delete this.cache[remotePath];
     }
   }
 
   checkCacheForUri(uri: string) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     return remotePath ? this.cache[remotePath] != null : false;
   }
 
@@ -98,6 +110,9 @@ export class SchemaCache {
   }
 
   fromCache(path: string): JsonSchemaInternal | undefined {
+    if (path === '__proto__' || path === 'constructor' || path === 'prototype') {
+      return undefined;
+    }
     let found = this.cache[path];
     if (found) {
       return found;
@@ -130,7 +145,7 @@ export class SchemaCache {
       }
     }
 
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     const queryPath = getQueryPath(uri);
     let result: JsonSchemaInternal | undefined;
     let resolvedFromAncestor = false;

package/src/schema-compiler.ts

@@ -3,10 +3,26 @@ import type { ZSchemaBase } from './z-schema-base.js';
 
 import { getId, isInternalKey, NON_SCHEMA_KEYWORDS } from './json-schema.js';
 import { Report } from './report.js';
+import { DEFAULT_MAX_RECURSION_DEPTH } from './utils/constants.js';
 import { getRemotePath, isAbsoluteUri } from './utils/uri.js';
-import { DEFAULT_MAX_RECURSION_DEPTH } from './z-schema-options.js';
 import { getSchemaReader } from './z-schema-reader.js';
 
+/** Safely assign a property on `obj`, refusing prototype-polluting keys. */
+function safeSetProperty(obj: Record<string, unknown>, key: string, value: unknown): void {
+  const unsafeTargets = [
+    Object.prototype as unknown as Record<string, unknown>,
+    Function.prototype as unknown as Record<string, unknown>,
+    Array.prototype as unknown as Record<string, unknown>,
+  ];
+  if (unsafeTargets.includes(obj)) {
+    return;
+  }
+  /** Reject property names that could pollute Object.prototype (CWE-1321). */
+  if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
+    obj[key] = value;
+  }
+}
+
 interface Id {
   id: string;
   type: 'absolute' | 'relative' | 'root';
@@ -213,7 +229,8 @@ const resolveReference = (base: string | undefined, ref: string) => {
 
   let baseDir = baseNoFrag;
   if (!baseDir.endsWith('/')) {
-    baseDir = baseDir.replace(/[^/]*$/, '');
+    const lastSlash = baseDir.lastIndexOf('/');
+    baseDir = lastSlash === -1 ? '' : baseDir.slice(0, lastSlash + 1);
   }
   return baseDir + ref;
 };
@@ -291,8 +308,18 @@ export class SchemaCompiler {
       }
     }
 
+    const canMutateSchemaObject =
+      schema !== (Object.prototype as unknown as JsonSchemaInternal) &&
+      schema !== (Function.prototype as unknown as JsonSchemaInternal) &&
+      schema !== (Array.prototype as unknown as JsonSchemaInternal);
+
     // if we have an id than it should be cached already (if this instance has compiled it)
-    if (schema.__$compiled && schema.id && this.validator.scache.checkCacheForUri(schema.id) === false) {
+    if (
+      canMutateSchemaObject &&
+      schema.__$compiled &&
+      schema.id &&
+      this.validator.scache.checkCacheForUri(schema.id) === false
+    ) {
       schema.__$compiled = undefined;
     }
 
@@ -302,7 +329,7 @@ export class SchemaCompiler {
     }
 
     // v8 - if $schema is not present, set $schema to default
-    if (!schema.$schema && this.validator.options.version !== 'none') {
+    if (canMutateSchemaObject && !schema.$schema && this.validator.options.version !== 'none') {
       schema.$schema = this.validator.getDefaultSchemaId();
     }
 
@@ -320,7 +347,9 @@ export class SchemaCompiler {
 
     // delete all __$missingReferences from previous compilation attempts
     const isValidExceptReferences = report.isValid();
-    delete schema.__$missingReferences;
+    if (canMutateSchemaObject) {
+      delete schema.__$missingReferences;
+    }
 
     // collect all references that need to be resolved - $ref and $schema
     const useRefObjectScope =
@@ -384,18 +413,18 @@ export class SchemaCompiler {
           report.path = report.path.slice(0, -refObj.path.length);
 
           // pusblish unresolved references out
-          if (isValidExceptReferences) {
+          if (isValidExceptReferences && canMutateSchemaObject) {
             schema.__$missingReferences = schema.__$missingReferences || [];
             schema.__$missingReferences.push(refObj);
           }
         }
       }
       // this might create circular references
-      refObj.obj[`__${refObj.key}Resolved`] = response;
+      safeSetProperty(refObj.obj as unknown as Record<string, unknown>, `__${refObj.key}Resolved`, response);
     }
 
     const isValid = report.isValid();
-    if (isValid) {
+    if (isValid && canMutateSchemaObject) {
       schema.__$compiled = true;
     }
     // else {
@@ -436,7 +465,7 @@ export class SchemaCompiler {
             const response = arr.find((x) => x.id === refObj.ref);
             if (response) {
               // this might create circular references
-              refObj.obj[`__${refObj.key}Resolved`] = response;
+              safeSetProperty(refObj.obj as unknown as Record<string, unknown>, `__${refObj.key}Resolved`, response);
               // it's resolved now so delete it
               sch.__$missingReferences.splice(idx2, 1);
             }

package/src/utils/clone.ts

@@ -1,4 +1,4 @@
-import { DEFAULT_MAX_RECURSION_DEPTH } from '../z-schema-options.js';
+import { DEFAULT_MAX_RECURSION_DEPTH } from './constants.js';
 import { copyProp } from './properties.js';
 
 export const shallowClone = <T>(src: T): T => {

package/src/utils/constants.ts

@@ -0,0 +1,21 @@
+/**
+ * Default maximum recursion depth for deeply nested schema/data traversal.
+ * Used as the default for {@link ZSchemaOptions.maxRecursionDepth} and
+ * internal helpers like `deepClone` and `collectIds`.
+ */
+export const DEFAULT_MAX_RECURSION_DEPTH = 100;
+
+/**
+ * Maximum allowed value for {@link ZSchemaOptions.asyncTimeout} in milliseconds.
+ * Values exceeding this limit are clamped during option normalization to
+ * prevent resource exhaustion (CWE-400).
+ */
+export const MAX_ASYNC_TIMEOUT = 60_000;
+
+/**
+ * Maximum allowed length for a JSON Schema `pattern` regular expression string.
+ * Patterns exceeding this limit are rejected by {@link compileSchemaRegex} to
+ * mitigate Regular Expression Denial-of-Service (CWE-1333) and regex injection
+ * (CWE-95).
+ */
+export const MAX_SCHEMA_REGEX_LENGTH = 10_000;

package/src/utils/json.ts

@@ -1,4 +1,4 @@
-import { DEFAULT_MAX_RECURSION_DEPTH } from '../z-schema-options.js';
+import { DEFAULT_MAX_RECURSION_DEPTH } from './constants.js';
 import { isObject } from './what-is.js';
 
 interface AreEqualOptions {

package/src/utils/schema-regex.ts

@@ -1,9 +1,21 @@
 // Shared regex compilation helper for JSON Schema patterns
 // Returns { ok: true, value: RegExp } or { ok: false, error: { pattern, message } }
 
+import { MAX_SCHEMA_REGEX_LENGTH } from './constants.js';
+
 export function compileSchemaRegex(
   pattern: string
 ): { ok: true; value: RegExp } | { ok: false; error: { pattern: string; message: string } } {
+  if (pattern.length > MAX_SCHEMA_REGEX_LENGTH) {
+    return {
+      ok: false,
+      error: {
+        pattern,
+        message: `Pattern length ${pattern.length} exceeds maximum allowed length of ${MAX_SCHEMA_REGEX_LENGTH}`,
+      },
+    };
+  }
+
   const unicodePropertyEscape = /\\[pP]{/;
   const nonBmpCharacter = /[\u{10000}-\u{10FFFF}]/u;
   const surrogatePairEscape = /\\uD[89AB][0-9A-Fa-f]{2}\\uD[CDEF][0-9A-Fa-f]{2}/;
@@ -13,6 +25,7 @@ export function compileSchemaRegex(
   if (needsUnicode) {
     // Try compiling with 'u' flag only
     try {
+      // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
       const re = new RegExp(pattern, 'u');
       return { ok: true, value: re };
     } catch (e: any) {
@@ -26,6 +39,7 @@ export function compileSchemaRegex(
     }
   } else {
     try {
+      // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
       const re = new RegExp(pattern);
       return { ok: true, value: re };
     } catch (e: any) {

package/src/validation/array.ts

@@ -2,7 +2,6 @@ import type { JsonSchemaInternal } from '../json-schema-versions.js';
 import type { Report } from '../report.js';
 import type { ZSchemaBase } from '../z-schema-base.js';
 
-import { validate } from '../json-validation.js';
 import { isUniqueArray } from '../utils/array.js';
 import { cacheValidationResult, deferOrRunSync, shouldSkipValidate } from './shared.js';
 
@@ -121,7 +120,7 @@ export function containsValidator(this: ZSchemaBase, report: Report, schema: Jso
   for (let idx = 0; idx < json.length; idx++) {
     const subReport = new Report_(report);
     subReports.push(subReport);
-    validate.call(this, subReport, containsSchema as any, json[idx]);
+    this._jsonValidate(subReport, containsSchema as any, json[idx]);
     cacheValidationResult(report, containsSchema, json[idx], subReport.errors.length === 0);
   }
 

package/src/validation/combinators.ts

@@ -1,7 +1,6 @@
 import type { JsonSchemaInternal } from '../json-schema-versions.js';
 import type { ZSchemaBase } from '../z-schema-base.js';
 
-import { validate } from '../json-validation.js';
 import { Report } from '../report.js';
 import { cacheValidationResult, deferOrRunSync } from './shared.js';
 
@@ -12,7 +11,7 @@ import { cacheValidationResult, deferOrRunSync } from './shared.js';
 export function allOfValidator(this: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
   // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.5.3.2
   for (let i = 0; i < schema.allOf!.length; i++) {
-    const validateResult = validate.call(this, report, schema.allOf![i], json);
+    const validateResult = this._jsonValidate(report, schema.allOf![i], json);
     if (this.options.breakOnFirstError && validateResult === false) {
       break;
     }
@@ -30,7 +29,7 @@ export function anyOfValidator(this: ZSchemaBase, report: Report, schema: JsonSc
   for (let i = 0; i < schema.anyOf!.length; i++) {
     const subReport = new Report(report);
     subReports.push(subReport);
-    validate.call(this, subReport, schema.anyOf![i], json);
+    this._jsonValidate(subReport, schema.anyOf![i], json);
     cacheValidationResult(report, schema.anyOf![i], json, subReport.errors.length === 0);
   }
 
@@ -61,7 +60,7 @@ export function oneOfValidator(this: ZSchemaBase, report: Report, schema: JsonSc
   for (let i = 0; i < schema.oneOf!.length; i++) {
     const subReport = new Report(report);
     subReports.push(subReport);
-    validate.call(this, subReport, schema.oneOf![i], json);
+    this._jsonValidate(subReport, schema.oneOf![i], json);
     cacheValidationResult(report, schema.oneOf![i], json, subReport.errors.length === 0);
   }
 
@@ -89,7 +88,7 @@ export function oneOfValidator(this: ZSchemaBase, report: Report, schema: JsonSc
 export function notValidator(this: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
   // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.5.6.2
   const subReport = new Report(report);
-  if (validate.call(this, subReport, schema.not!, json) === true) {
+  if (this._jsonValidate(subReport, schema.not!, json) === true) {
     report.addError('NOT_PASSED', undefined, undefined, schema, 'not');
   }
 }
@@ -112,7 +111,7 @@ export function ifValidator(this: ZSchemaBase, report: Report, schema: JsonSchem
   }
 
   const conditionReport = new Report(report);
-  validate.call(this, conditionReport, conditionSchema as any, json);
+  this._jsonValidate(conditionReport, conditionSchema as any, json);
   cacheValidationResult(report, conditionSchema, json, conditionReport.errors.length === 0);
 
   const branchSchema = conditionReport.errors.length === 0 ? thenSchema : elseSchema;
@@ -120,7 +119,7 @@ export function ifValidator(this: ZSchemaBase, report: Report, schema: JsonSchem
     return;
   }
 
-  validate.call(this, report, branchSchema as any, json);
+  this._jsonValidate(report, branchSchema as any, json);
 }
 
 export function thenValidator() {

package/src/validation/object.ts

@@ -2,7 +2,6 @@ import type { JsonSchemaInternal } from '../json-schema-versions.js';
 import type { Report } from '../report.js';
 import type { ZSchemaBase } from '../z-schema-base.js';
 
-import { validate } from '../json-validation.js';
 import { difference } from '../utils/array.js';
 import { compileSchemaRegex } from '../utils/schema-regex.js';
 import { isObject } from '../utils/what-is.js';
@@ -200,7 +199,7 @@ export function dependenciesValidator(this: ZSchemaBase, report: Report, schema:
         }
       } else {
         // if dependency is a schema, validate against this schema
-        validate.call(this, report, dependencyDefinition, json);
+        this._jsonValidate(report, dependencyDefinition, json);
       }
     }
   }
@@ -228,7 +227,7 @@ export function dependentSchemasValidator(
   for (const dependencyName of keys) {
     if (Object.hasOwn(json, dependencyName)) {
       const dependencySchema = schema.dependentSchemas[dependencyName];
-      validate.call(this, report, dependencySchema, json);
+      this._jsonValidate(report, dependencySchema, json);
     }
   }
 }
@@ -303,7 +302,7 @@ export function propertyNamesValidator(this: ZSchemaBase, report: Report, schema
   for (const key of keys) {
     const subReport = new Report_(report);
     subReports.push(subReport);
-    validate.call(this, subReport, propertyNamesSchema as any, key);
+    this._jsonValidate(subReport, propertyNamesSchema as any, key);
   }
 
   const addPropertyNameErrors = () => {

package/src/validation/string.ts

@@ -107,21 +107,13 @@ export function formatValidator(this: ZSchemaBase, report: Report, schema: JsonS
       const result = formatValidatorFn.call(this, json);
       if (result instanceof Promise) {
         // Promise-based async
-        const timeoutMs = this.options.asyncTimeout || 2000;
         const promiseResult = result;
         report.addAsyncTaskWithPath(
           async (callback) => {
             try {
-              const timeoutPromise = new Promise<never>((_, reject) => {
-                setTimeout(() => reject(new Error('Async timeout')), timeoutMs);
-              });
-              const resolved = await Promise.race([promiseResult, timeoutPromise]);
+              const resolved = await promiseResult;
               callback(resolved);
-            } catch (error) {
-              if ((error as Error).message === 'Async timeout') {
-                // Don't call callback, let global timeout handle it
-                return;
-              }
+            } catch (_error) {
               callback(false);
             }
           },

package/src/z-schema-base.ts

@@ -54,6 +54,17 @@ export class ZSchemaBase {
     this.options = normalizeOptions(options);
   }
 
+  /**
+   * Internal recursive JSON validation — delegates to the `validate` function
+   * in `json-validation.ts`. Exposed as a method so that per-keyword validator
+   * modules (array, combinators, object) can call back into the core validator
+   * via `this` without importing `json-validation.ts` directly (which would
+   * create a circular dependency).
+   */
+  _jsonValidate(report: Report, schema: boolean | JsonSchemaInternal, json: unknown): boolean {
+    return validateJson.call(this, report, schema, json);
+  }
+
   getDefaultSchemaId(): string {
     return this.options.version && this.options.version !== 'none'
       ? VERSION_SCHEMA_URL_MAPPING[this.options.version]

package/src/z-schema-options.ts

@@ -3,8 +3,9 @@ import type { Report } from './report.js';
 
 import { CURRENT_DEFAULT_SCHEMA_VERSION, type JsonSchemaVersion } from './json-schema-versions.js';
 import { shallowClone } from './utils/clone.js';
+import { DEFAULT_MAX_RECURSION_DEPTH, MAX_ASYNC_TIMEOUT } from './utils/constants.js';
 
-export const DEFAULT_MAX_RECURSION_DEPTH = 100;
+export { DEFAULT_MAX_RECURSION_DEPTH, MAX_ASYNC_TIMEOUT };
 
 export interface ZSchemaOptions {
   version?: JsonSchemaVersion | 'none';
@@ -119,6 +120,11 @@ export const normalizeOptions = (options?: ZSchemaOptions) => {
     normalized = shallowClone(defaultOptions);
   }
 
+  // Clamp asyncTimeout to prevent resource exhaustion (CWE-400)
+  if (normalized.asyncTimeout != null) {
+    normalized.asyncTimeout = Math.min(Math.max(normalized.asyncTimeout, 0), MAX_ASYNC_TIMEOUT);
+  }
+
   if (normalized.strictMode === true) {
     normalized.forceAdditional = true;
     normalized.forceItems = true;