z-schema 12.0.1 → 12.0.2

package/cjs/index.js

@@ -364,6 +364,7 @@ const get = (obj, path) => {
 const jsonSymbol = Symbol.for('z-schema/json');
 const schemaSymbol = Symbol.for('z-schema/schema');
 
+const ASYNC_TIMEOUT_POLL_MS = 10;
 class Report {
     asyncTasks = [];
     commonErrorMessage;
@@ -438,6 +439,7 @@ class Report {
     }
     processAsyncTasks(timeout, callback) {
         const validationTimeout = Math.min(Math.max(timeout || 2000, 0), MAX_ASYNC_TIMEOUT);
+        const timeoutAt = Date.now() + validationTimeout;
         let tasksCount = this.asyncTasks.length;
         let timedOut = false;
         const finish = () => {
@@ -466,13 +468,19 @@ class Report {
             const respondCallback = respond(processFn);
             fn(...fnArgs, respondCallback);
         }
-        setTimeout(() => {
-            if (tasksCount > 0) {
+        const checkTimeout = () => {
+            if (timedOut || tasksCount <= 0) {
+                return;
+            }
+            if (Date.now() >= timeoutAt) {
                 timedOut = true;
                 this.addError('ASYNC_TIMEOUT', [tasksCount, validationTimeout]);
                 callback(getValidateError({ details: this.errors }), false);
+                return;
             }
-        }, validationTimeout);
+            setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
+        };
+        setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
     }
     getPath(returnPathAsString) {
         let path = [];
@@ -720,6 +728,17 @@ const normalizeOptions = (options) => {
     return normalized;
 };
 
+// Normalize a URI into a cache key, rejecting keys that could pollute Object.prototype.
+function getSafeRemotePath(uri) {
+    const remotePath = getRemotePath(uri);
+    if (!remotePath) {
+        return undefined;
+    }
+    if (remotePath === '__proto__' || remotePath === 'constructor' || remotePath === 'prototype') {
+        return undefined;
+    }
+    return remotePath;
+}
 const getEffectiveId = (schema) => {
     let id = getId(schema);
     if ((!id || !isAbsoluteUri(id)) && typeof schema.id === 'string' && isAbsoluteUri(schema.id)) {
@@ -750,31 +769,31 @@ function prepareRemoteSchema(schema, uri, validationOptions, maxCloneDepth) {
 }
 class SchemaCache {
     validator;
-    static global_cache = {};
-    cache = {};
+    static global_cache = Object.create(null);
+    cache = Object.create(null);
     constructor(validator) {
         this.validator = validator;
     }
     static cacheSchemaByUri(uri, schema) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             this.global_cache[remotePath] = schema;
         }
     }
     cacheSchemaByUri(uri, schema) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             this.cache[remotePath] = schema;
         }
     }
     removeFromCacheByUri(uri) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             delete this.cache[remotePath];
         }
     }
     checkCacheForUri(uri) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         return remotePath ? this.cache[remotePath] != null : false;
     }
     getSchema(report, refOrSchema) {
@@ -789,6 +808,9 @@ class SchemaCache {
         return deepClone(refOrSchema, this.validator.options.maxRecursionDepth);
     }
     fromCache(path) {
+        if (path === '__proto__' || path === 'constructor' || path === 'prototype') {
+            return undefined;
+        }
         let found = this.cache[path];
         if (found) {
             return found;
@@ -820,7 +842,7 @@ class SchemaCache {
                 }
             }
         }
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         const queryPath = getQueryPath(uri);
         let result;
         let resolvedFromAncestor = false;
@@ -4523,6 +4545,7 @@ function compileSchemaRegex(pattern) {
     if (needsUnicode) {
         // Try compiling with 'u' flag only
         try {
+            // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
             const re = new RegExp(pattern, 'u');
             return { ok: true, value: re };
         }
@@ -4538,6 +4561,7 @@ function compileSchemaRegex(pattern) {
     }
     else {
         try {
+            // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
             const re = new RegExp(pattern);
             return { ok: true, value: re };
         }
@@ -5520,21 +5544,13 @@ function formatValidator(report, schema, json) {
             const result = formatValidatorFn.call(this, json);
             if (result instanceof Promise) {
                 // Promise-based async
-                const timeoutMs = Math.min(Math.max(this.options.asyncTimeout || 2000, 0), MAX_ASYNC_TIMEOUT);
                 const promiseResult = result;
                 report.addAsyncTaskWithPath(async (callback) => {
                     try {
-                        const timeoutPromise = new Promise((_, reject) => {
-                            setTimeout(() => reject(new Error('Async timeout')), timeoutMs);
-                        });
-                        const resolved = await Promise.race([promiseResult, timeoutPromise]);
+                        const resolved = await promiseResult;
                         callback(resolved);
                     }
-                    catch (error) {
-                        if (error.message === 'Async timeout') {
-                            // Don't call callback, let global timeout handle it
-                            return;
-                        }
+                    catch (_error) {
                         callback(false);
                     }
                 }, [], function (resolvedResult) {
@@ -6384,6 +6400,14 @@ function setSchemaReader(schemaReader) {
 
 /** Safely assign a property on `obj`, refusing prototype-polluting keys. */
 function safeSetProperty(obj, key, value) {
+    const unsafeTargets = [
+        Object.prototype,
+        Function.prototype,
+        Array.prototype,
+    ];
+    if (unsafeTargets.includes(obj)) {
+        return;
+    }
     /** Reject property names that could pollute Object.prototype (CWE-1321). */
     if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
         obj[key] = value;
@@ -6626,8 +6650,14 @@ class SchemaCompiler {
                 this.collectAndCacheIds(schema);
             }
         }
+        const canMutateSchemaObject = schema !== Object.prototype &&
+            schema !== Function.prototype &&
+            schema !== Array.prototype;
         // if we have an id than it should be cached already (if this instance has compiled it)
-        if (schema.__$compiled && schema.id && this.validator.scache.checkCacheForUri(schema.id) === false) {
+        if (canMutateSchemaObject &&
+            schema.__$compiled &&
+            schema.id &&
+            this.validator.scache.checkCacheForUri(schema.id) === false) {
             schema.__$compiled = undefined;
         }
         // do not re-compile schemas
@@ -6635,7 +6665,7 @@ class SchemaCompiler {
             return true;
         }
         // v8 - if $schema is not present, set $schema to default
-        if (!schema.$schema && this.validator.options.version !== 'none') {
+        if (canMutateSchemaObject && !schema.$schema && this.validator.options.version !== 'none') {
             schema.$schema = this.validator.getDefaultSchemaId();
         }
         if (schema.id && typeof schema.id === 'string' && !options?.noCache) {
@@ -6650,7 +6680,9 @@ class SchemaCompiler {
         }
         // delete all __$missingReferences from previous compilation attempts
         const isValidExceptReferences = report.isValid();
-        delete schema.__$missingReferences;
+        if (canMutateSchemaObject) {
+            delete schema.__$missingReferences;
+        }
         // collect all references that need to be resolved - $ref and $schema
         const useRefObjectScope = this.validator.options.version === 'draft2019-09' || this.validator.options.version === 'draft2020-12';
         const refs = collectReferences(schema, undefined, undefined, undefined, { useRefObjectScope }, this.validator.options.maxRecursionDepth);
@@ -6698,7 +6730,7 @@ class SchemaCompiler {
                     report.addError('UNRESOLVABLE_REFERENCE', [refObj.ref]);
                     report.path = report.path.slice(0, -refObj.path.length);
                     // pusblish unresolved references out
-                    if (isValidExceptReferences) {
+                    if (isValidExceptReferences && canMutateSchemaObject) {
                         schema.__$missingReferences = schema.__$missingReferences || [];
                         schema.__$missingReferences.push(refObj);
                     }
@@ -6708,7 +6740,7 @@ class SchemaCompiler {
             safeSetProperty(refObj.obj, `__${refObj.key}Resolved`, response);
         }
         const isValid = report.isValid();
-        if (isValid) {
+        if (isValid && canMutateSchemaObject) {
             schema.__$compiled = true;
         }
         // else {

package/dist/report.js

@@ -5,6 +5,7 @@ import { get } from './utils/json.js';
 import { jsonSymbol, schemaSymbol } from './utils/symbols.js';
 import { isAbsoluteUri } from './utils/uri.js';
 import { isObject } from './utils/what-is.js';
+const ASYNC_TIMEOUT_POLL_MS = 10;
 export class Report {
     asyncTasks = [];
     commonErrorMessage;
@@ -79,6 +80,7 @@ export class Report {
     }
     processAsyncTasks(timeout, callback) {
         const validationTimeout = Math.min(Math.max(timeout || 2000, 0), MAX_ASYNC_TIMEOUT);
+        const timeoutAt = Date.now() + validationTimeout;
         let tasksCount = this.asyncTasks.length;
         let timedOut = false;
         const finish = () => {
@@ -107,13 +109,19 @@ export class Report {
             const respondCallback = respond(processFn);
             fn(...fnArgs, respondCallback);
         }
-        setTimeout(() => {
-            if (tasksCount > 0) {
+        const checkTimeout = () => {
+            if (timedOut || tasksCount <= 0) {
+                return;
+            }
+            if (Date.now() >= timeoutAt) {
                 timedOut = true;
                 this.addError('ASYNC_TIMEOUT', [tasksCount, validationTimeout]);
                 callback(getValidateError({ details: this.errors }), false);
+                return;
             }
-        }, validationTimeout);
+            setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
+        };
+        setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
     }
     getPath(returnPathAsString) {
         let path = [];

package/dist/schema-cache.js

@@ -4,6 +4,17 @@ import { deepClone } from './utils/clone.js';
 import { decodeJSONPointer } from './utils/json.js';
 import { getQueryPath, getRemotePath, isAbsoluteUri } from './utils/uri.js';
 import { normalizeOptions } from './z-schema-options.js';
+// Normalize a URI into a cache key, rejecting keys that could pollute Object.prototype.
+function getSafeRemotePath(uri) {
+    const remotePath = getRemotePath(uri);
+    if (!remotePath) {
+        return undefined;
+    }
+    if (remotePath === '__proto__' || remotePath === 'constructor' || remotePath === 'prototype') {
+        return undefined;
+    }
+    return remotePath;
+}
 const getEffectiveId = (schema) => {
     let id = getId(schema);
     if ((!id || !isAbsoluteUri(id)) && typeof schema.id === 'string' && isAbsoluteUri(schema.id)) {
@@ -34,31 +45,31 @@ export function prepareRemoteSchema(schema, uri, validationOptions, maxCloneDept
 }
 export class SchemaCache {
     validator;
-    static global_cache = {};
-    cache = {};
+    static global_cache = Object.create(null);
+    cache = Object.create(null);
     constructor(validator) {
         this.validator = validator;
     }
     static cacheSchemaByUri(uri, schema) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             this.global_cache[remotePath] = schema;
         }
     }
     cacheSchemaByUri(uri, schema) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             this.cache[remotePath] = schema;
         }
     }
     removeFromCacheByUri(uri) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             delete this.cache[remotePath];
         }
     }
     checkCacheForUri(uri) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         return remotePath ? this.cache[remotePath] != null : false;
     }
     getSchema(report, refOrSchema) {
@@ -73,6 +84,9 @@ export class SchemaCache {
         return deepClone(refOrSchema, this.validator.options.maxRecursionDepth);
     }
     fromCache(path) {
+        if (path === '__proto__' || path === 'constructor' || path === 'prototype') {
+            return undefined;
+        }
         let found = this.cache[path];
         if (found) {
             return found;
@@ -104,7 +118,7 @@ export class SchemaCache {
                 }
             }
         }
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         const queryPath = getQueryPath(uri);
         let result;
         let resolvedFromAncestor = false;

package/dist/schema-compiler.js

@@ -5,6 +5,14 @@ import { getRemotePath, isAbsoluteUri } from './utils/uri.js';
 import { getSchemaReader } from './z-schema-reader.js';
 /** Safely assign a property on `obj`, refusing prototype-polluting keys. */
 function safeSetProperty(obj, key, value) {
+    const unsafeTargets = [
+        Object.prototype,
+        Function.prototype,
+        Array.prototype,
+    ];
+    if (unsafeTargets.includes(obj)) {
+        return;
+    }
     /** Reject property names that could pollute Object.prototype (CWE-1321). */
     if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
         obj[key] = value;
@@ -247,8 +255,14 @@ export class SchemaCompiler {
                 this.collectAndCacheIds(schema);
             }
         }
+        const canMutateSchemaObject = schema !== Object.prototype &&
+            schema !== Function.prototype &&
+            schema !== Array.prototype;
         // if we have an id than it should be cached already (if this instance has compiled it)
-        if (schema.__$compiled && schema.id && this.validator.scache.checkCacheForUri(schema.id) === false) {
+        if (canMutateSchemaObject &&
+            schema.__$compiled &&
+            schema.id &&
+            this.validator.scache.checkCacheForUri(schema.id) === false) {
             schema.__$compiled = undefined;
         }
         // do not re-compile schemas
@@ -256,7 +270,7 @@ export class SchemaCompiler {
             return true;
         }
         // v8 - if $schema is not present, set $schema to default
-        if (!schema.$schema && this.validator.options.version !== 'none') {
+        if (canMutateSchemaObject && !schema.$schema && this.validator.options.version !== 'none') {
             schema.$schema = this.validator.getDefaultSchemaId();
         }
         if (schema.id && typeof schema.id === 'string' && !options?.noCache) {
@@ -271,7 +285,9 @@ export class SchemaCompiler {
         }
         // delete all __$missingReferences from previous compilation attempts
         const isValidExceptReferences = report.isValid();
-        delete schema.__$missingReferences;
+        if (canMutateSchemaObject) {
+            delete schema.__$missingReferences;
+        }
         // collect all references that need to be resolved - $ref and $schema
         const useRefObjectScope = this.validator.options.version === 'draft2019-09' || this.validator.options.version === 'draft2020-12';
         const refs = collectReferences(schema, undefined, undefined, undefined, { useRefObjectScope }, this.validator.options.maxRecursionDepth);
@@ -325,7 +341,7 @@ export class SchemaCompiler {
                     report.addError('UNRESOLVABLE_REFERENCE', [refObj.ref]);
                     report.path = report.path.slice(0, -refObj.path.length);
                     // pusblish unresolved references out
-                    if (isValidExceptReferences) {
+                    if (isValidExceptReferences && canMutateSchemaObject) {
                         schema.__$missingReferences = schema.__$missingReferences || [];
                         schema.__$missingReferences.push(refObj);
                     }
@@ -335,7 +351,7 @@ export class SchemaCompiler {
             safeSetProperty(refObj.obj, `__${refObj.key}Resolved`, response);
         }
         const isValid = report.isValid();
-        if (isValid) {
+        if (isValid && canMutateSchemaObject) {
             schema.__$compiled = true;
         }
         // else {

package/dist/utils/schema-regex.js

@@ -19,6 +19,7 @@ export function compileSchemaRegex(pattern) {
     if (needsUnicode) {
         // Try compiling with 'u' flag only
         try {
+            // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
             const re = new RegExp(pattern, 'u');
             return { ok: true, value: re };
         }
@@ -34,6 +35,7 @@ export function compileSchemaRegex(pattern) {
     }
     else {
         try {
+            // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
             const re = new RegExp(pattern);
             return { ok: true, value: re };
         }

package/dist/validation/string.js

@@ -1,6 +1,5 @@
 import { getFormatValidators } from '../format-validators.js';
 import { decodeBase64, isValidBase64 } from '../utils/base64.js';
-import { MAX_ASYNC_TIMEOUT } from '../utils/constants.js';
 import { compileSchemaRegex } from '../utils/schema-regex.js';
 import { unicodeLength } from '../utils/unicode.js';
 import { whatIs } from '../utils/what-is.js';
@@ -94,21 +93,13 @@ export function formatValidator(report, schema, json) {
             const result = formatValidatorFn.call(this, json);
             if (result instanceof Promise) {
                 // Promise-based async
-                const timeoutMs = Math.min(Math.max(this.options.asyncTimeout || 2000, 0), MAX_ASYNC_TIMEOUT);
                 const promiseResult = result;
                 report.addAsyncTaskWithPath(async (callback) => {
                     try {
-                        const timeoutPromise = new Promise((_, reject) => {
-                            setTimeout(() => reject(new Error('Async timeout')), timeoutMs);
-                        });
-                        const resolved = await Promise.race([promiseResult, timeoutPromise]);
+                        const resolved = await promiseResult;
                         callback(resolved);
                     }
-                    catch (error) {
-                        if (error.message === 'Async timeout') {
-                            // Don't call callback, let global timeout handle it
-                            return;
-                        }
+                    catch (_error) {
                         callback(false);
                     }
                 }, [], function (resolvedResult) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "z-schema",
-  "version": "12.0.1",
+  "version": "12.0.2",
   "engines": {
     "node": ">=22.0.0"
   },

package/src/report.ts

@@ -11,6 +11,8 @@ import { jsonSymbol, schemaSymbol } from './utils/symbols.js';
 import { isAbsoluteUri } from './utils/uri.js';
 import { isObject } from './utils/what-is.js';
 
+const ASYNC_TIMEOUT_POLL_MS = 10;
+
 export interface SchemaErrorDetail {
   /**
    * Example: "Expected type string but found type array"
@@ -160,6 +162,7 @@ export class Report {
 
   processAsyncTasks(timeout: number | undefined, callback: ValidateCallback) {
     const validationTimeout = Math.min(Math.max(timeout || 2000, 0), MAX_ASYNC_TIMEOUT);
+    const timeoutAt = Date.now() + validationTimeout;
     let tasksCount = this.asyncTasks.length;
     let timedOut = false;
 
@@ -193,13 +196,19 @@ export class Report {
       fn(...fnArgs, respondCallback);
     }
 
-    setTimeout(() => {
-      if (tasksCount > 0) {
+    const checkTimeout = () => {
+      if (timedOut || tasksCount <= 0) {
+        return;
+      }
+      if (Date.now() >= timeoutAt) {
         timedOut = true;
         this.addError('ASYNC_TIMEOUT', [tasksCount, validationTimeout]);
         callback(getValidateError({ details: this.errors }), false);
+        return;
       }
-    }, validationTimeout);
+      setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
+    };
+    setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
   }
 
   getPath(returnPathAsString?: boolean) {

package/src/schema-cache.ts

@@ -12,6 +12,18 @@ import { normalizeOptions } from './z-schema-options.js';
 export type SchemaCacheStorage = Record<string, JsonSchemaInternal>;
 export type ReferenceSchemaCacheStorage = Array<[JsonSchemaInternal, JsonSchemaInternal]>;
 
+// Normalize a URI into a cache key, rejecting keys that could pollute Object.prototype.
+function getSafeRemotePath(uri: string): string | undefined {
+  const remotePath = getRemotePath(uri);
+  if (!remotePath) {
+    return undefined;
+  }
+  if (remotePath === '__proto__' || remotePath === 'constructor' || remotePath === 'prototype') {
+    return undefined;
+  }
+  return remotePath;
+}
+
 const getEffectiveId = (schema: JsonSchemaInternal): string | undefined => {
   let id = getId(schema);
   if ((!id || !isAbsoluteUri(id)) && typeof schema.id === 'string' && isAbsoluteUri(schema.id)) {
@@ -51,34 +63,34 @@ export function prepareRemoteSchema(
 }
 
 export class SchemaCache {
-  static global_cache: SchemaCacheStorage = {};
-  cache: SchemaCacheStorage = {};
+  static global_cache: SchemaCacheStorage = Object.create(null);
+  cache: SchemaCacheStorage = Object.create(null);
 
   constructor(private validator: ZSchemaBase) {}
 
   static cacheSchemaByUri(uri: string, schema: JsonSchemaInternal) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     if (remotePath) {
       this.global_cache[remotePath] = schema;
     }
   }
 
   cacheSchemaByUri(uri: string, schema: JsonSchemaInternal) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     if (remotePath) {
       this.cache[remotePath] = schema;
     }
   }
 
   removeFromCacheByUri(uri: string) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     if (remotePath) {
       delete this.cache[remotePath];
     }
   }
 
   checkCacheForUri(uri: string) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     return remotePath ? this.cache[remotePath] != null : false;
   }
 
@@ -98,6 +110,9 @@ export class SchemaCache {
   }
 
   fromCache(path: string): JsonSchemaInternal | undefined {
+    if (path === '__proto__' || path === 'constructor' || path === 'prototype') {
+      return undefined;
+    }
     let found = this.cache[path];
     if (found) {
       return found;
@@ -130,7 +145,7 @@ export class SchemaCache {
       }
     }
 
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     const queryPath = getQueryPath(uri);
     let result: JsonSchemaInternal | undefined;
     let resolvedFromAncestor = false;

package/src/schema-compiler.ts

@@ -9,6 +9,14 @@ import { getSchemaReader } from './z-schema-reader.js';
 
 /** Safely assign a property on `obj`, refusing prototype-polluting keys. */
 function safeSetProperty(obj: Record<string, unknown>, key: string, value: unknown): void {
+  const unsafeTargets = [
+    Object.prototype as unknown as Record<string, unknown>,
+    Function.prototype as unknown as Record<string, unknown>,
+    Array.prototype as unknown as Record<string, unknown>,
+  ];
+  if (unsafeTargets.includes(obj)) {
+    return;
+  }
   /** Reject property names that could pollute Object.prototype (CWE-1321). */
   if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
     obj[key] = value;
@@ -300,8 +308,18 @@ export class SchemaCompiler {
       }
     }
 
+    const canMutateSchemaObject =
+      schema !== (Object.prototype as unknown as JsonSchemaInternal) &&
+      schema !== (Function.prototype as unknown as JsonSchemaInternal) &&
+      schema !== (Array.prototype as unknown as JsonSchemaInternal);
+
     // if we have an id than it should be cached already (if this instance has compiled it)
-    if (schema.__$compiled && schema.id && this.validator.scache.checkCacheForUri(schema.id) === false) {
+    if (
+      canMutateSchemaObject &&
+      schema.__$compiled &&
+      schema.id &&
+      this.validator.scache.checkCacheForUri(schema.id) === false
+    ) {
       schema.__$compiled = undefined;
     }
 
@@ -311,7 +329,7 @@ export class SchemaCompiler {
     }
 
     // v8 - if $schema is not present, set $schema to default
-    if (!schema.$schema && this.validator.options.version !== 'none') {
+    if (canMutateSchemaObject && !schema.$schema && this.validator.options.version !== 'none') {
       schema.$schema = this.validator.getDefaultSchemaId();
     }
 
@@ -329,7 +347,9 @@ export class SchemaCompiler {
 
     // delete all __$missingReferences from previous compilation attempts
     const isValidExceptReferences = report.isValid();
-    delete schema.__$missingReferences;
+    if (canMutateSchemaObject) {
+      delete schema.__$missingReferences;
+    }
 
     // collect all references that need to be resolved - $ref and $schema
     const useRefObjectScope =
@@ -393,7 +413,7 @@ export class SchemaCompiler {
           report.path = report.path.slice(0, -refObj.path.length);
 
           // pusblish unresolved references out
-          if (isValidExceptReferences) {
+          if (isValidExceptReferences && canMutateSchemaObject) {
             schema.__$missingReferences = schema.__$missingReferences || [];
             schema.__$missingReferences.push(refObj);
           }
@@ -404,7 +424,7 @@ export class SchemaCompiler {
     }
 
     const isValid = report.isValid();
-    if (isValid) {
+    if (isValid && canMutateSchemaObject) {
       schema.__$compiled = true;
     }
     // else {

package/src/utils/schema-regex.ts

@@ -25,6 +25,7 @@ export function compileSchemaRegex(
   if (needsUnicode) {
     // Try compiling with 'u' flag only
     try {
+      // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
       const re = new RegExp(pattern, 'u');
       return { ok: true, value: re };
     } catch (e: any) {
@@ -38,6 +39,7 @@ export function compileSchemaRegex(
     }
   } else {
     try {
+      // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
       const re = new RegExp(pattern);
       return { ok: true, value: re };
     } catch (e: any) {