z-schema 12.0.0 → 12.0.2

package/umd/ZSchema.js

@@ -17,6 +17,26 @@
     };
     const isAbsoluteUri = (uri) => /^[a-zA-Z][a-zA-Z\d+.-]*:/.test(uri);
 
+    /**
+     * Default maximum recursion depth for deeply nested schema/data traversal.
+     * Used as the default for {@link ZSchemaOptions.maxRecursionDepth} and
+     * internal helpers like `deepClone` and `collectIds`.
+     */
+    const DEFAULT_MAX_RECURSION_DEPTH = 100;
+    /**
+     * Maximum allowed value for {@link ZSchemaOptions.asyncTimeout} in milliseconds.
+     * Values exceeding this limit are clamped during option normalization to
+     * prevent resource exhaustion (CWE-400).
+     */
+    const MAX_ASYNC_TIMEOUT = 60_000;
+    /**
+     * Maximum allowed length for a JSON Schema `pattern` regular expression string.
+     * Patterns exceeding this limit are rejected by {@link compileSchemaRegex} to
+     * mitigate Regular Expression Denial-of-Service (CWE-1333) and regex injection
+     * (CWE-95).
+     */
+    const MAX_SCHEMA_REGEX_LENGTH = 10_000;
+
     const whatIs = (what) => {
         if (typeof what === 'object') {
             if (what === null) {
@@ -50,177 +70,6 @@
         return typeof value === 'number' && Number.isFinite(value) && value % 1 === 0;
     }
 
-    const CURRENT_DEFAULT_SCHEMA_VERSION = 'draft2020-12';
-    const VERSION_SCHEMA_URL_MAPPING = {
-        'draft-04': 'http://json-schema.org/draft-04/schema#',
-        'draft-06': 'http://json-schema.org/draft-06/schema#',
-        'draft-07': 'http://json-schema.org/draft-07/schema#',
-        'draft2019-09': 'https://json-schema.org/draft/2019-09/schema',
-        'draft2020-12': 'https://json-schema.org/draft/2020-12/schema',
-    };
-
-    function copyProp(from, to, key, fn) {
-        if (Object.hasOwn(from, key)) {
-            Object.defineProperty(to, key, {
-                value: fn ? fn(from[key]) : from[key],
-                enumerable: true,
-                writable: true,
-                configurable: true,
-            });
-        }
-    }
-
-    const shallowClone = (src) => {
-        if (src == null || typeof src !== 'object') {
-            return src;
-        }
-        let res;
-        if (Array.isArray(src)) {
-            res = [];
-            for (let i = 0; i < src.length; i++) {
-                res[i] = src[i];
-            }
-        }
-        else {
-            res = {};
-            const keys = Object.keys(src).sort();
-            for (const key of keys) {
-                copyProp(src, res, key);
-            }
-        }
-        return res;
-    };
-    const deepClone = (src, maxDepth = DEFAULT_MAX_RECURSION_DEPTH) => {
-        let vidx = 0;
-        const visited = new Map();
-        const cloned = [];
-        const cloneDeepInner = (src, _depth) => {
-            if (typeof src !== 'object' || src === null) {
-                return src;
-            }
-            if (_depth >= maxDepth) {
-                throw new Error(`Maximum recursion depth (${maxDepth}) exceeded in deepClone. ` +
-                    'If your schema or data is deeply nested and valid, increase the maxRecursionDepth option.');
-            }
-            let res;
-            const cidx = visited.get(src);
-            if (cidx !== undefined) {
-                return cloned[cidx];
-            }
-            visited.set(src, vidx++);
-            if (Array.isArray(src)) {
-                res = [];
-                cloned.push(res);
-                for (let i = 0; i < src.length; i++) {
-                    res[i] = cloneDeepInner(src[i], _depth + 1);
-                }
-            }
-            else {
-                res = {};
-                cloned.push(res);
-                const keys = Object.keys(src).sort();
-                for (const key of keys) {
-                    copyProp(src, res, key, (v) => cloneDeepInner(v, _depth + 1));
-                }
-            }
-            return res;
-        };
-        return cloneDeepInner(src, 0);
-    };
-
-    const DEFAULT_MAX_RECURSION_DEPTH = 100;
-    const defaultOptions = {
-        // default version to validate against
-        version: CURRENT_DEFAULT_SCHEMA_VERSION,
-        // default timeout for all async tasks
-        asyncTimeout: 2000,
-        // force additionalProperties and additionalItems to be defined on "object" and "array" types
-        forceAdditional: false,
-        // assume additionalProperties and additionalItems are defined as "false" where appropriate
-        assumeAdditional: false,
-        // do case insensitive comparison for enums
-        enumCaseInsensitiveComparison: false,
-        // force items to be defined on "array" types
-        forceItems: false,
-        // force minItems to be defined on "array" types
-        forceMinItems: false,
-        // force maxItems to be defined on "array" types
-        forceMaxItems: false,
-        // force minLength to be defined on "string" types
-        forceMinLength: false,
-        // force maxLength to be defined on "string" types
-        forceMaxLength: false,
-        // force properties or patternProperties to be defined on "object" types
-        forceProperties: false,
-        // ignore references that cannot be resolved (remote schemas)
-        ignoreUnresolvableReferences: false,
-        // disallow usage of keywords that this validator can't handle
-        noExtraKeywords: false,
-        // disallow usage of schema's without "type" defined
-        noTypeless: false,
-        // disallow zero length strings in validated objects
-        noEmptyStrings: false,
-        // disallow zero length arrays in validated objects
-        noEmptyArrays: false,
-        // forces "uri" format to be in fully rfc3986 compliant
-        strictUris: false,
-        // turn on some of the above
-        strictMode: false,
-        // report error paths as an array of path segments to get to the offending node
-        reportPathAsArray: false,
-        // stop validation as soon as an error is found
-        breakOnFirstError: false,
-        // check if schema follows best practices and common sense
-        pedanticCheck: false,
-        // ignore unknown formats (do not report them as an error)
-        ignoreUnknownFormats: false,
-        // control format assertion behavior:
-        //   true  - respect vocabulary: for draft 2019-09/2020-12, check meta-schema $vocabulary
-        //           to determine if format is assertion or annotation-only
-        //   false - format is always annotation-only (never asserts)
-        //   null  - legacy behavior: always assert format validation
-        formatAssertions: null,
-        // function to be called on every schema
-        customValidator: null,
-        // maximum recursion depth for deeply nested schema/data traversal (prevents stack overflow)
-        maxRecursionDepth: DEFAULT_MAX_RECURSION_DEPTH,
-    };
-    const normalizeOptions = (options) => {
-        let normalized;
-        // options
-        if (typeof options === 'object') {
-            let keys = Object.keys(options);
-            // check that the options are correctly configured
-            for (const key of keys) {
-                if (defaultOptions[key] === undefined) {
-                    throw new Error('Unexpected option passed to constructor: ' + key);
-                }
-            }
-            // copy the default options into passed options
-            keys = Object.keys(defaultOptions);
-            for (const key of keys) {
-                if (options[key] === undefined) {
-                    options[key] = shallowClone(defaultOptions[key]);
-                }
-            }
-            normalized = options;
-        }
-        else {
-            normalized = shallowClone(defaultOptions);
-        }
-        if (normalized.strictMode === true) {
-            normalized.forceAdditional = true;
-            normalized.forceItems = true;
-            normalized.forceMaxLength = true;
-            normalized.forceProperties = true;
-            normalized.noExtraKeywords = true;
-            normalized.noTypeless = true;
-            normalized.noEmptyStrings = true;
-            normalized.noEmptyArrays = true;
-        }
-        return normalized;
-    };
-
     /**
      * Keywords whose values are not JSON Schema sub-schemas and must not be
      * traversed during schema walking (id collection, reference collection, etc.).
@@ -376,6 +225,75 @@
         return new ValidateError(message || '', details);
     }
 
+    function copyProp(from, to, key, fn) {
+        if (Object.hasOwn(from, key)) {
+            Object.defineProperty(to, key, {
+                value: fn ? fn(from[key]) : from[key],
+                enumerable: true,
+                writable: true,
+                configurable: true,
+            });
+        }
+    }
+
+    const shallowClone = (src) => {
+        if (src == null || typeof src !== 'object') {
+            return src;
+        }
+        let res;
+        if (Array.isArray(src)) {
+            res = [];
+            for (let i = 0; i < src.length; i++) {
+                res[i] = src[i];
+            }
+        }
+        else {
+            res = {};
+            const keys = Object.keys(src).sort();
+            for (const key of keys) {
+                copyProp(src, res, key);
+            }
+        }
+        return res;
+    };
+    const deepClone = (src, maxDepth = DEFAULT_MAX_RECURSION_DEPTH) => {
+        let vidx = 0;
+        const visited = new Map();
+        const cloned = [];
+        const cloneDeepInner = (src, _depth) => {
+            if (typeof src !== 'object' || src === null) {
+                return src;
+            }
+            if (_depth >= maxDepth) {
+                throw new Error(`Maximum recursion depth (${maxDepth}) exceeded in deepClone. ` +
+                    'If your schema or data is deeply nested and valid, increase the maxRecursionDepth option.');
+            }
+            let res;
+            const cidx = visited.get(src);
+            if (cidx !== undefined) {
+                return cloned[cidx];
+            }
+            visited.set(src, vidx++);
+            if (Array.isArray(src)) {
+                res = [];
+                cloned.push(res);
+                for (let i = 0; i < src.length; i++) {
+                    res[i] = cloneDeepInner(src[i], _depth + 1);
+                }
+            }
+            else {
+                res = {};
+                cloned.push(res);
+                const keys = Object.keys(src).sort();
+                for (const key of keys) {
+                    copyProp(src, res, key, (v) => cloneDeepInner(v, _depth + 1));
+                }
+            }
+            return res;
+        };
+        return cloneDeepInner(src, 0);
+    };
+
     const areEqual = (json1, json2, options, _depth = 0) => {
         const caseInsensitiveComparison = options?.caseInsensitiveComparison || false;
         const maxDepth = options?.maxDepth ?? DEFAULT_MAX_RECURSION_DEPTH;
@@ -448,6 +366,7 @@
     const jsonSymbol = Symbol.for('z-schema/json');
     const schemaSymbol = Symbol.for('z-schema/schema');
 
+    const ASYNC_TIMEOUT_POLL_MS = 10;
     class Report {
         asyncTasks = [];
         commonErrorMessage;
@@ -521,7 +440,8 @@
             return this.parentReport.getAncestor(id);
         }
         processAsyncTasks(timeout, callback) {
-            const validationTimeout = timeout || 2000;
+            const validationTimeout = Math.min(Math.max(timeout || 2000, 0), MAX_ASYNC_TIMEOUT);
+            const timeoutAt = Date.now() + validationTimeout;
             let tasksCount = this.asyncTasks.length;
             let timedOut = false;
             const finish = () => {
@@ -550,13 +470,19 @@
                 const respondCallback = respond(processFn);
                 fn(...fnArgs, respondCallback);
             }
-            setTimeout(() => {
-                if (tasksCount > 0) {
+            const checkTimeout = () => {
+                if (timedOut || tasksCount <= 0) {
+                    return;
+                }
+                if (Date.now() >= timeoutAt) {
                     timedOut = true;
                     this.addError('ASYNC_TIMEOUT', [tasksCount, validationTimeout]);
                     callback(getValidateError({ details: this.errors }), false);
+                    return;
                 }
-            }, validationTimeout);
+                setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
+            };
+            setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
         }
         getPath(returnPathAsString) {
             let path = [];
@@ -699,6 +625,122 @@
         }
     }
 
+    const CURRENT_DEFAULT_SCHEMA_VERSION = 'draft2020-12';
+    const VERSION_SCHEMA_URL_MAPPING = {
+        'draft-04': 'http://json-schema.org/draft-04/schema#',
+        'draft-06': 'http://json-schema.org/draft-06/schema#',
+        'draft-07': 'http://json-schema.org/draft-07/schema#',
+        'draft2019-09': 'https://json-schema.org/draft/2019-09/schema',
+        'draft2020-12': 'https://json-schema.org/draft/2020-12/schema',
+    };
+
+    const defaultOptions = {
+        // default version to validate against
+        version: CURRENT_DEFAULT_SCHEMA_VERSION,
+        // default timeout for all async tasks
+        asyncTimeout: 2000,
+        // force additionalProperties and additionalItems to be defined on "object" and "array" types
+        forceAdditional: false,
+        // assume additionalProperties and additionalItems are defined as "false" where appropriate
+        assumeAdditional: false,
+        // do case insensitive comparison for enums
+        enumCaseInsensitiveComparison: false,
+        // force items to be defined on "array" types
+        forceItems: false,
+        // force minItems to be defined on "array" types
+        forceMinItems: false,
+        // force maxItems to be defined on "array" types
+        forceMaxItems: false,
+        // force minLength to be defined on "string" types
+        forceMinLength: false,
+        // force maxLength to be defined on "string" types
+        forceMaxLength: false,
+        // force properties or patternProperties to be defined on "object" types
+        forceProperties: false,
+        // ignore references that cannot be resolved (remote schemas)
+        ignoreUnresolvableReferences: false,
+        // disallow usage of keywords that this validator can't handle
+        noExtraKeywords: false,
+        // disallow usage of schema's without "type" defined
+        noTypeless: false,
+        // disallow zero length strings in validated objects
+        noEmptyStrings: false,
+        // disallow zero length arrays in validated objects
+        noEmptyArrays: false,
+        // forces "uri" format to be in fully rfc3986 compliant
+        strictUris: false,
+        // turn on some of the above
+        strictMode: false,
+        // report error paths as an array of path segments to get to the offending node
+        reportPathAsArray: false,
+        // stop validation as soon as an error is found
+        breakOnFirstError: false,
+        // check if schema follows best practices and common sense
+        pedanticCheck: false,
+        // ignore unknown formats (do not report them as an error)
+        ignoreUnknownFormats: false,
+        // control format assertion behavior:
+        //   true  - respect vocabulary: for draft 2019-09/2020-12, check meta-schema $vocabulary
+        //           to determine if format is assertion or annotation-only
+        //   false - format is always annotation-only (never asserts)
+        //   null  - legacy behavior: always assert format validation
+        formatAssertions: null,
+        // function to be called on every schema
+        customValidator: null,
+        // maximum recursion depth for deeply nested schema/data traversal (prevents stack overflow)
+        maxRecursionDepth: DEFAULT_MAX_RECURSION_DEPTH,
+    };
+    const normalizeOptions = (options) => {
+        let normalized;
+        // options
+        if (typeof options === 'object') {
+            let keys = Object.keys(options);
+            // check that the options are correctly configured
+            for (const key of keys) {
+                if (defaultOptions[key] === undefined) {
+                    throw new Error('Unexpected option passed to constructor: ' + key);
+                }
+            }
+            // copy the default options into passed options
+            keys = Object.keys(defaultOptions);
+            for (const key of keys) {
+                if (options[key] === undefined) {
+                    options[key] = shallowClone(defaultOptions[key]);
+                }
+            }
+            normalized = options;
+        }
+        else {
+            normalized = shallowClone(defaultOptions);
+        }
+        // Clamp asyncTimeout to prevent resource exhaustion (CWE-400)
+        if (normalized.asyncTimeout != null) {
+            normalized.asyncTimeout = Math.min(Math.max(normalized.asyncTimeout, 0), MAX_ASYNC_TIMEOUT);
+        }
+        if (normalized.strictMode === true) {
+            normalized.forceAdditional = true;
+            normalized.forceItems = true;
+            normalized.forceMaxLength = true;
+            normalized.forceProperties = true;
+            normalized.noExtraKeywords = true;
+            normalized.noTypeless = true;
+            normalized.noEmptyStrings = true;
+            normalized.noEmptyArrays = true;
+        }
+        return normalized;
+    };
+
+    // Normalize a URI into a cache key, rejecting keys that could pollute Object.prototype.
+    function getSafeRemotePath(uri) {
+        const remotePath = getRemotePath(uri);
+        if (!remotePath) {
+            return undefined;
+        }
+        if (remotePath === '__proto__' || remotePath === 'constructor' || remotePath === 'prototype') {
+            return undefined;
+        }
+        return remotePath;
+    }
     const getEffectiveId = (schema) => {
         let id = getId(schema);
         if ((!id || !isAbsoluteUri(id)) && typeof schema.id === 'string' && isAbsoluteUri(schema.id)) {
@@ -729,31 +771,31 @@
     }
     class SchemaCache {
         validator;
-        static global_cache = {};
-        cache = {};
+        static global_cache = Object.create(null);
+        cache = Object.create(null);
         constructor(validator) {
             this.validator = validator;
         }
         static cacheSchemaByUri(uri, schema) {
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             if (remotePath) {
                 this.global_cache[remotePath] = schema;
             }
         }
         cacheSchemaByUri(uri, schema) {
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             if (remotePath) {
                 this.cache[remotePath] = schema;
             }
         }
         removeFromCacheByUri(uri) {
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             if (remotePath) {
                 delete this.cache[remotePath];
             }
         }
         checkCacheForUri(uri) {
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             return remotePath ? this.cache[remotePath] != null : false;
         }
         getSchema(report, refOrSchema) {
@@ -768,6 +810,9 @@
             return deepClone(refOrSchema, this.validator.options.maxRecursionDepth);
         }
         fromCache(path) {
+            if (path === '__proto__' || path === 'constructor' || path === 'prototype') {
+                return undefined;
+            }
             let found = this.cache[path];
             if (found) {
                 return found;
@@ -799,7 +844,7 @@
                     }
                 }
             }
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             const queryPath = getQueryPath(uri);
             let result;
             let resolvedFromAncestor = false;
@@ -4333,19 +4378,55 @@
         }
         return !inExpression;
     };
+    const hasValidTildeEscapes = (segment) => {
+        for (let i = 0; i < segment.length; i++) {
+            if (segment[i] === '~') {
+                const next = segment[i + 1];
+                if (next !== '0' && next !== '1') {
+                    return false;
+                }
+                i++; // skip the escape character
+            }
+        }
+        return true;
+    };
     const jsonPointerValidator = (pointer) => {
         if (typeof pointer !== 'string')
             return true;
         // JSON Pointer: empty, or a sequence of '/'-prefixed reference tokens.
         // In each token, '~' must be escaped as '~0' or '~1'.
-        return pointer === '' || /^(?:\/(?:[^~]|~0|~1)*)+$/.test(pointer);
+        if (pointer === '')
+            return true;
+        if (!/^(?:\/[^/]*)+$/.test(pointer))
+            return false;
+        const tokens = pointer.split('/').slice(1); // first element is empty before leading '/'
+        for (const token of tokens) {
+            if (!hasValidTildeEscapes(token))
+                return false;
+        }
+        return true;
     };
     const relativeJsonPointerValidator = (pointer) => {
         if (typeof pointer !== 'string')
             return true;
         // Relative JSON Pointer: non-negative integer prefix (no leading zeros unless zero),
         // followed by either '#', a JSON Pointer, or nothing.
-        return /^(?:0|[1-9]\d*)(?:#|(?:\/(?:[^~]|~0|~1)*)+)?$/.test(pointer);
+        const match = pointer.match(/^(0|[1-9]\d*)(.*)$/);
+        if (!match)
+            return false;
+        const suffix = match[2];
+        if (suffix === '' || suffix === '#')
+            return true;
+        if (!suffix.startsWith('/'))
+            return false;
+        if (!/^(?:\/[^/]*)+$/.test(suffix))
+            return false;
+        const tokens = suffix.split('/').slice(1);
+        for (const token of tokens) {
+            if (!hasValidTildeEscapes(token))
+                return false;
+        }
+        return true;
     };
     const timeValidator = (time) => {
         if (typeof time !== 'string')
@@ -4449,6 +4530,15 @@
     // Shared regex compilation helper for JSON Schema patterns
     // Returns { ok: true, value: RegExp } or { ok: false, error: { pattern, message } }
     function compileSchemaRegex(pattern) {
+        if (pattern.length > MAX_SCHEMA_REGEX_LENGTH) {
+            return {
+                ok: false,
+                error: {
+                    pattern,
+                    message: `Pattern length ${pattern.length} exceeds maximum allowed length of ${MAX_SCHEMA_REGEX_LENGTH}`,
+                },
+            };
+        }
         const unicodePropertyEscape = /\\[pP]{/;
         const nonBmpCharacter = /[\u{10000}-\u{10FFFF}]/u;
         const surrogatePairEscape = /\\uD[89AB][0-9A-Fa-f]{2}\\uD[CDEF][0-9A-Fa-f]{2}/;
@@ -4457,6 +4547,7 @@
         if (needsUnicode) {
             // Try compiling with 'u' flag only
             try {
+                // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
                 const re = new RegExp(pattern, 'u');
                 return { ok: true, value: re };
             }
@@ -4472,6 +4563,7 @@
         }
         else {
             try {
+                // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
                 const re = new RegExp(pattern);
                 return { ok: true, value: re };
             }
@@ -4791,7 +4883,7 @@
         for (let idx = 0; idx < json.length; idx++) {
             const subReport = new Report_(report);
             subReports.push(subReport);
-            validate.call(this, subReport, containsSchema, json[idx]);
+            this._jsonValidate(subReport, containsSchema, json[idx]);
             cacheValidationResult(report, containsSchema, json[idx], subReport.errors.length === 0);
         }
         const addContainsErrorIfNeeded = () => {
@@ -4824,7 +4916,7 @@
     function allOfValidator(report, schema, json) {
         // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.5.3.2
         for (let i = 0; i < schema.allOf.length; i++) {
-            const validateResult = validate.call(this, report, schema.allOf[i], json);
+            const validateResult = this._jsonValidate(report, schema.allOf[i], json);
             if (this.options.breakOnFirstError && validateResult === false) {
                 break;
             }
@@ -4839,7 +4931,7 @@
         for (let i = 0; i < schema.anyOf.length; i++) {
             const subReport = new Report(report);
             subReports.push(subReport);
-            validate.call(this, subReport, schema.anyOf[i], json);
+            this._jsonValidate(subReport, schema.anyOf[i], json);
             cacheValidationResult(report, schema.anyOf[i], json, subReport.errors.length === 0);
         }
         // Aggregate async tasks and decide when ready
@@ -4865,7 +4957,7 @@
         for (let i = 0; i < schema.oneOf.length; i++) {
             const subReport = new Report(report);
             subReports.push(subReport);
-            validate.call(this, subReport, schema.oneOf[i], json);
+            this._jsonValidate(subReport, schema.oneOf[i], json);
             cacheValidationResult(report, schema.oneOf[i], json, subReport.errors.length === 0);
         }
         // Aggregate async tasks and decide when ready
@@ -4890,7 +4982,7 @@
     function notValidator(report, schema, json) {
         // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.5.6.2
         const subReport = new Report(report);
-        if (validate.call(this, subReport, schema.not, json) === true) {
+        if (this._jsonValidate(subReport, schema.not, json) === true) {
             report.addError('NOT_PASSED', undefined, undefined, schema, 'not');
         }
     }
@@ -4908,13 +5000,13 @@
             return;
         }
         const conditionReport = new Report(report);
-        validate.call(this, conditionReport, conditionSchema, json);
+        this._jsonValidate(conditionReport, conditionSchema, json);
         cacheValidationResult(report, conditionSchema, json, conditionReport.errors.length === 0);
         const branchSchema = conditionReport.errors.length === 0 ? thenSchema : elseSchema;
         if (branchSchema === undefined) {
             return;
         }
-        validate.call(this, report, branchSchema, json);
+        this._jsonValidate(report, branchSchema, json);
     }
     function thenValidator() {
         // handled by if
@@ -5170,7 +5262,7 @@
                 }
                 else {
                     // if dependency is a schema, validate against this schema
-                    validate.call(this, report, dependencyDefinition, json);
+                    this._jsonValidate(report, dependencyDefinition, json);
                 }
             }
         }
@@ -5189,7 +5281,7 @@
         for (const dependencyName of keys) {
             if (Object.hasOwn(json, dependencyName)) {
                 const dependencySchema = schema.dependentSchemas[dependencyName];
-                validate.call(this, report, dependencySchema, json);
+                this._jsonValidate(report, dependencySchema, json);
             }
         }
     }
@@ -5242,7 +5334,7 @@
         for (const key of keys) {
             const subReport = new Report_(report);
             subReports.push(subReport);
-            validate.call(this, subReport, propertyNamesSchema, key);
+            this._jsonValidate(subReport, propertyNamesSchema, key);
         }
         const addPropertyNameErrors = () => {
             for (let idx = 0; idx < keys.length; idx++) {
@@ -5454,21 +5546,13 @@
                 const result = formatValidatorFn.call(this, json);
                 if (result instanceof Promise) {
                     // Promise-based async
-                    const timeoutMs = this.options.asyncTimeout || 2000;
                     const promiseResult = result;
                     report.addAsyncTaskWithPath(async (callback) => {
                         try {
-                            const timeoutPromise = new Promise((_, reject) => {
-                                setTimeout(() => reject(new Error('Async timeout')), timeoutMs);
-                            });
-                            const resolved = await Promise.race([promiseResult, timeoutPromise]);
+                            const resolved = await promiseResult;
                             callback(resolved);
                         }
-                        catch (error) {
-                            if (error.message === 'Async timeout') {
-                                // Don't call callback, let global timeout handle it
-                                return;
-                            }
+                        catch (_error) {
                             callback(false);
                         }
                     }, [], function (resolvedResult) {
@@ -6316,6 +6400,21 @@
         _schemaReader = schemaReader;
     }
 
+    /** Safely assign a property on `obj`, refusing prototype-polluting keys. */
+    function safeSetProperty(obj, key, value) {
+        const unsafeTargets = [
+            Object.prototype,
+            Function.prototype,
+            Array.prototype,
+        ];
+        if (unsafeTargets.includes(obj)) {
+            return;
+        }
+        /** Reject property names that could pollute Object.prototype (CWE-1321). */
+        if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
+            obj[key] = value;
+        }
+    }
     const collectIds = (obj, maxDepth = DEFAULT_MAX_RECURSION_DEPTH) => {
         const ids = [];
         function walk(node, scope, _depth = 0) {
@@ -6481,7 +6580,8 @@
         }
         let baseDir = baseNoFrag;
         if (!baseDir.endsWith('/')) {
-            baseDir = baseDir.replace(/[^/]*$/, '');
+            const lastSlash = baseDir.lastIndexOf('/');
+            baseDir = lastSlash === -1 ? '' : baseDir.slice(0, lastSlash + 1);
         }
         return baseDir + ref;
     };
@@ -6552,8 +6652,14 @@
                     this.collectAndCacheIds(schema);
                 }
             }
+            const canMutateSchemaObject = schema !== Object.prototype &&
+                schema !== Function.prototype &&
+                schema !== Array.prototype;
             // if we have an id than it should be cached already (if this instance has compiled it)
-            if (schema.__$compiled && schema.id && this.validator.scache.checkCacheForUri(schema.id) === false) {
+            if (canMutateSchemaObject &&
+                schema.__$compiled &&
+                schema.id &&
+                this.validator.scache.checkCacheForUri(schema.id) === false) {
                 schema.__$compiled = undefined;
             }
             // do not re-compile schemas
@@ -6561,7 +6667,7 @@
                 return true;
             }
             // v8 - if $schema is not present, set $schema to default
-            if (!schema.$schema && this.validator.options.version !== 'none') {
+            if (canMutateSchemaObject && !schema.$schema && this.validator.options.version !== 'none') {
                 schema.$schema = this.validator.getDefaultSchemaId();
             }
             if (schema.id && typeof schema.id === 'string' && !options?.noCache) {
@@ -6576,7 +6682,9 @@
             }
             // delete all __$missingReferences from previous compilation attempts
             const isValidExceptReferences = report.isValid();
-            delete schema.__$missingReferences;
+            if (canMutateSchemaObject) {
+                delete schema.__$missingReferences;
+            }
             // collect all references that need to be resolved - $ref and $schema
             const useRefObjectScope = this.validator.options.version === 'draft2019-09' || this.validator.options.version === 'draft2020-12';
             const refs = collectReferences(schema, undefined, undefined, undefined, { useRefObjectScope }, this.validator.options.maxRecursionDepth);
@@ -6624,17 +6732,17 @@
                         report.addError('UNRESOLVABLE_REFERENCE', [refObj.ref]);
                         report.path = report.path.slice(0, -refObj.path.length);
                         // pusblish unresolved references out
-                        if (isValidExceptReferences) {
+                        if (isValidExceptReferences && canMutateSchemaObject) {
                             schema.__$missingReferences = schema.__$missingReferences || [];
                             schema.__$missingReferences.push(refObj);
                         }
                     }
                 }
                 // this might create circular references
-                refObj.obj[`__${refObj.key}Resolved`] = response;
+                safeSetProperty(refObj.obj, `__${refObj.key}Resolved`, response);
             }
             const isValid = report.isValid();
-            if (isValid) {
+            if (isValid && canMutateSchemaObject) {
                 schema.__$compiled = true;
             }
             // else {
@@ -6667,7 +6775,7 @@
                             const response = arr.find((x) => x.id === refObj.ref);
                             if (response) {
                                 // this might create circular references
-                                refObj.obj[`__${refObj.key}Resolved`] = response;
+                                safeSetProperty(refObj.obj, `__${refObj.key}Resolved`, response);
                                 // it's resolved now so delete it
                                 sch.__$missingReferences.splice(idx2, 1);
                             }
@@ -7431,6 +7539,16 @@
             this.sv = new SchemaValidator(this);
             this.options = normalizeOptions(options);
         }
+        /**
+         * Internal recursive JSON validation — delegates to the `validate` function
+         * in `json-validation.ts`. Exposed as a method so that per-keyword validator
+         * modules (array, combinators, object) can call back into the core validator
+         * via `this` without importing `json-validation.ts` directly (which would
+         * create a circular dependency).
+         */
+        _jsonValidate(report, schema, json) {
+            return validate.call(this, report, schema, json);
+        }
         getDefaultSchemaId() {
             return this.options.version && this.options.version !== 'none'
                 ? VERSION_SCHEMA_URL_MAPPING[this.options.version]