z-schema 12.0.1 → 12.0.3

package/src/format-validators.ts

@@ -157,7 +157,9 @@ const durationValidator: FormatValidatorFn = (input: unknown) => {
   const datePart = parts[0];
   const timePart = parts.length === 2 ? parts[1] : undefined;
 
-  if (!/^(?:\d+Y)?(?:\d+M)?(?:\d+D)?$/.test(datePart)) {
+  // RFC 3339 Appendix A ABNF: dur-year = 1*DIGIT "Y" [dur-month], dur-month = 1*DIGIT "M" [dur-day]
+  // Y can only be followed by M (not D directly), so P1Y2D is invalid
+  if (datePart.length > 0 && !/^(?:\d+Y(?:\d+M(?:\d+D)?)?|\d+M(?:\d+D)?|\d+D)$/.test(datePart)) {
     return false;
   }
 
@@ -168,7 +170,9 @@ const durationValidator: FormatValidatorFn = (input: unknown) => {
     if (timePart.length === 0) {
       return false;
     }
-    if (!/^(?:\d+H)?(?:\d+M)?(?:\d+S)?$/.test(timePart)) {
+    // RFC 3339 Appendix A ABNF: dur-hour = 1*DIGIT "H" [dur-minute], dur-minute = 1*DIGIT "M" [dur-second]
+    // H can only be followed by M (not S directly), so PT1H2S is invalid
+    if (!/^(?:\d+H(?:\d+M(?:\d+S)?)?|\d+M(?:\d+S)?|\d+S)$/.test(timePart)) {
       return false;
     }
     hasTimeComponent = /\d+[HMS]/.test(timePart);
@@ -189,11 +193,23 @@ const uuidValidator: FormatValidatorFn = (input: unknown) => {
 
 const strictUriValidator: FormatValidatorFn = (uri: unknown) => typeof uri !== 'string' || isURLModule.default(uri);
 
+const hasValidPercentEncoding = (str: string): boolean => {
+  for (let i = 0; i < str.length; i++) {
+    if (str[i] === '%') {
+      if (i + 2 >= str.length || !/[0-9a-fA-F]/.test(str[i + 1]) || !/[0-9a-fA-F]/.test(str[i + 2])) {
+        return false;
+      }
+    }
+  }
+  return true;
+};
+
 const uriValidator: FormatValidatorFn = function (uri: unknown) {
   if (typeof uri !== 'string') return true;
   // eslint-disable-next-line no-control-regex
   if (/[^\x00-\x7F]/.test(uri)) return false;
-  const match = uri.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/]*)/);
+  if (!hasValidPercentEncoding(uri)) return false;
+  const match = uri.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/?#]*)/);
   if (match) {
     const authority = match[2];
     const atIndex = authority.indexOf('@');
@@ -203,6 +219,21 @@ const uriValidator: FormatValidatorFn = function (uri: unknown) {
         return false;
       }
     }
+    // Validate port: must be numeric
+    let hostPort = atIndex >= 0 ? authority.substring(atIndex + 1) : authority;
+    if (hostPort.startsWith('[')) {
+      const bracketEnd = hostPort.indexOf(']');
+      if (bracketEnd >= 0) {
+        hostPort = hostPort.substring(bracketEnd + 1);
+      }
+    }
+    const colonIndex = hostPort.lastIndexOf(':');
+    if (colonIndex >= 0) {
+      const port = hostPort.substring(colonIndex + 1);
+      if (port.length > 0 && !/^\d+$/.test(port)) {
+        return false;
+      }
+    }
   }
   return /^[a-zA-Z][a-zA-Z0-9+.-]*:[^"\\<>^{}^`| ]*$/.test(uri);
 };

package/src/report.ts

@@ -11,6 +11,8 @@ import { jsonSymbol, schemaSymbol } from './utils/symbols.js';
 import { isAbsoluteUri } from './utils/uri.js';
 import { isObject } from './utils/what-is.js';
 
+const ASYNC_TIMEOUT_POLL_MS = 10;
+
 export interface SchemaErrorDetail {
   /**
    * Example: "Expected type string but found type array"
@@ -160,6 +162,7 @@ export class Report {
 
   processAsyncTasks(timeout: number | undefined, callback: ValidateCallback) {
     const validationTimeout = Math.min(Math.max(timeout || 2000, 0), MAX_ASYNC_TIMEOUT);
+    const timeoutAt = Date.now() + validationTimeout;
     let tasksCount = this.asyncTasks.length;
     let timedOut = false;
 
@@ -193,13 +196,19 @@ export class Report {
       fn(...fnArgs, respondCallback);
     }
 
-    setTimeout(() => {
-      if (tasksCount > 0) {
+    const checkTimeout = () => {
+      if (timedOut || tasksCount <= 0) {
+        return;
+      }
+      if (Date.now() >= timeoutAt) {
         timedOut = true;
         this.addError('ASYNC_TIMEOUT', [tasksCount, validationTimeout]);
         callback(getValidateError({ details: this.errors }), false);
+        return;
       }
-    }, validationTimeout);
+      setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
+    };
+    setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
   }
 
   getPath(returnPathAsString?: boolean) {

package/src/schema-cache.ts

@@ -12,6 +12,18 @@ import { normalizeOptions } from './z-schema-options.js';
 export type SchemaCacheStorage = Record<string, JsonSchemaInternal>;
 export type ReferenceSchemaCacheStorage = Array<[JsonSchemaInternal, JsonSchemaInternal]>;
 
+// Normalize a URI into a cache key, rejecting keys that could pollute Object.prototype.
+function getSafeRemotePath(uri: string): string | undefined {
+  const remotePath = getRemotePath(uri);
+  if (!remotePath) {
+    return undefined;
+  }
+  if (remotePath === '__proto__' || remotePath === 'constructor' || remotePath === 'prototype') {
+    return undefined;
+  }
+  return remotePath;
+}
+
 const getEffectiveId = (schema: JsonSchemaInternal): string | undefined => {
   let id = getId(schema);
   if ((!id || !isAbsoluteUri(id)) && typeof schema.id === 'string' && isAbsoluteUri(schema.id)) {
@@ -51,34 +63,34 @@ export function prepareRemoteSchema(
 }
 
 export class SchemaCache {
-  static global_cache: SchemaCacheStorage = {};
-  cache: SchemaCacheStorage = {};
+  static global_cache: SchemaCacheStorage = Object.create(null);
+  cache: SchemaCacheStorage = Object.create(null);
 
   constructor(private validator: ZSchemaBase) {}
 
   static cacheSchemaByUri(uri: string, schema: JsonSchemaInternal) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     if (remotePath) {
       this.global_cache[remotePath] = schema;
     }
   }
 
   cacheSchemaByUri(uri: string, schema: JsonSchemaInternal) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     if (remotePath) {
       this.cache[remotePath] = schema;
     }
   }
 
   removeFromCacheByUri(uri: string) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     if (remotePath) {
       delete this.cache[remotePath];
     }
   }
 
   checkCacheForUri(uri: string) {
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     return remotePath ? this.cache[remotePath] != null : false;
   }
 
@@ -98,6 +110,9 @@ export class SchemaCache {
   }
 
   fromCache(path: string): JsonSchemaInternal | undefined {
+    if (path === '__proto__' || path === 'constructor' || path === 'prototype') {
+      return undefined;
+    }
     let found = this.cache[path];
     if (found) {
       return found;
@@ -130,7 +145,7 @@ export class SchemaCache {
       }
     }
 
-    const remotePath = getRemotePath(uri);
+    const remotePath = getSafeRemotePath(uri);
     const queryPath = getQueryPath(uri);
     let result: JsonSchemaInternal | undefined;
     let resolvedFromAncestor = false;

package/src/schema-compiler.ts

@@ -9,6 +9,14 @@ import { getSchemaReader } from './z-schema-reader.js';
 
 /** Safely assign a property on `obj`, refusing prototype-polluting keys. */
 function safeSetProperty(obj: Record<string, unknown>, key: string, value: unknown): void {
+  const unsafeTargets = [
+    Object.prototype as unknown as Record<string, unknown>,
+    Function.prototype as unknown as Record<string, unknown>,
+    Array.prototype as unknown as Record<string, unknown>,
+  ];
+  if (unsafeTargets.includes(obj)) {
+    return;
+  }
   /** Reject property names that could pollute Object.prototype (CWE-1321). */
   if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
     obj[key] = value;
@@ -300,8 +308,18 @@ export class SchemaCompiler {
       }
     }
 
+    const canMutateSchemaObject =
+      schema !== (Object.prototype as unknown as JsonSchemaInternal) &&
+      schema !== (Function.prototype as unknown as JsonSchemaInternal) &&
+      schema !== (Array.prototype as unknown as JsonSchemaInternal);
+
     // if we have an id than it should be cached already (if this instance has compiled it)
-    if (schema.__$compiled && schema.id && this.validator.scache.checkCacheForUri(schema.id) === false) {
+    if (
+      canMutateSchemaObject &&
+      schema.__$compiled &&
+      schema.id &&
+      this.validator.scache.checkCacheForUri(schema.id) === false
+    ) {
       schema.__$compiled = undefined;
     }
 
@@ -311,7 +329,7 @@ export class SchemaCompiler {
     }
 
     // v8 - if $schema is not present, set $schema to default
-    if (!schema.$schema && this.validator.options.version !== 'none') {
+    if (canMutateSchemaObject && !schema.$schema && this.validator.options.version !== 'none') {
       schema.$schema = this.validator.getDefaultSchemaId();
     }
 
@@ -329,7 +347,9 @@ export class SchemaCompiler {
 
     // delete all __$missingReferences from previous compilation attempts
     const isValidExceptReferences = report.isValid();
-    delete schema.__$missingReferences;
+    if (canMutateSchemaObject) {
+      delete schema.__$missingReferences;
+    }
 
     // collect all references that need to be resolved - $ref and $schema
     const useRefObjectScope =
@@ -393,7 +413,7 @@ export class SchemaCompiler {
           report.path = report.path.slice(0, -refObj.path.length);
 
           // pusblish unresolved references out
-          if (isValidExceptReferences) {
+          if (isValidExceptReferences && canMutateSchemaObject) {
             schema.__$missingReferences = schema.__$missingReferences || [];
             schema.__$missingReferences.push(refObj);
           }
@@ -404,7 +424,7 @@ export class SchemaCompiler {
     }
 
     const isValid = report.isValid();
-    if (isValid) {
+    if (isValid && canMutateSchemaObject) {
       schema.__$compiled = true;
     }
     // else {

package/src/utils/schema-regex.ts

@@ -25,6 +25,7 @@ export function compileSchemaRegex(
   if (needsUnicode) {
     // Try compiling with 'u' flag only
     try {
+      // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
       const re = new RegExp(pattern, 'u');
       return { ok: true, value: re };
     } catch (e: any) {
@@ -38,6 +39,7 @@ export function compileSchemaRegex(
     }
   } else {
     try {
+      // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
       const re = new RegExp(pattern);
       return { ok: true, value: re };
     } catch (e: any) {

package/src/validation/string.ts

@@ -4,7 +4,6 @@ import type { ZSchemaBase } from '../z-schema-base.js';
 
 import { getFormatValidators } from '../format-validators.js';
 import { decodeBase64, isValidBase64 } from '../utils/base64.js';
-import { MAX_ASYNC_TIMEOUT } from '../utils/constants.js';
 import { compileSchemaRegex } from '../utils/schema-regex.js';
 import { unicodeLength } from '../utils/unicode.js';
 import { whatIs } from '../utils/what-is.js';
@@ -108,21 +107,13 @@ export function formatValidator(this: ZSchemaBase, report: Report, schema: JsonS
       const result = formatValidatorFn.call(this, json);
       if (result instanceof Promise) {
         // Promise-based async
-        const timeoutMs = Math.min(Math.max(this.options.asyncTimeout || 2000, 0), MAX_ASYNC_TIMEOUT);
         const promiseResult = result;
         report.addAsyncTaskWithPath(
           async (callback) => {
             try {
-              const timeoutPromise = new Promise<never>((_, reject) => {
-                setTimeout(() => reject(new Error('Async timeout')), timeoutMs);
-              });
-              const resolved = await Promise.race([promiseResult, timeoutPromise]);
+              const resolved = await promiseResult;
               callback(resolved);
-            } catch (error) {
-              if ((error as Error).message === 'Async timeout') {
-                // Don't call callback, let global timeout handle it
-                return;
-              }
+            } catch (_error) {
               callback(false);
             }
           },

package/umd/ZSchema.js

@@ -366,6 +366,7 @@
     const jsonSymbol = Symbol.for('z-schema/json');
     const schemaSymbol = Symbol.for('z-schema/schema');
 
+    const ASYNC_TIMEOUT_POLL_MS = 10;
     class Report {
         asyncTasks = [];
         commonErrorMessage;
@@ -440,6 +441,7 @@
         }
         processAsyncTasks(timeout, callback) {
             const validationTimeout = Math.min(Math.max(timeout || 2000, 0), MAX_ASYNC_TIMEOUT);
+            const timeoutAt = Date.now() + validationTimeout;
             let tasksCount = this.asyncTasks.length;
             let timedOut = false;
             const finish = () => {
@@ -468,13 +470,19 @@
                 const respondCallback = respond(processFn);
                 fn(...fnArgs, respondCallback);
             }
-            setTimeout(() => {
-                if (tasksCount > 0) {
+            const checkTimeout = () => {
+                if (timedOut || tasksCount <= 0) {
+                    return;
+                }
+                if (Date.now() >= timeoutAt) {
                     timedOut = true;
                     this.addError('ASYNC_TIMEOUT', [tasksCount, validationTimeout]);
                     callback(getValidateError({ details: this.errors }), false);
+                    return;
                 }
-            }, validationTimeout);
+                setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
+            };
+            setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
         }
         getPath(returnPathAsString) {
             let path = [];
@@ -722,6 +730,17 @@
         return normalized;
     };
 
+    // Normalize a URI into a cache key, rejecting keys that could pollute Object.prototype.
+    function getSafeRemotePath(uri) {
+        const remotePath = getRemotePath(uri);
+        if (!remotePath) {
+            return undefined;
+        }
+        if (remotePath === '__proto__' || remotePath === 'constructor' || remotePath === 'prototype') {
+            return undefined;
+        }
+        return remotePath;
+    }
     const getEffectiveId = (schema) => {
         let id = getId(schema);
         if ((!id || !isAbsoluteUri(id)) && typeof schema.id === 'string' && isAbsoluteUri(schema.id)) {
@@ -752,31 +771,31 @@
     }
     class SchemaCache {
         validator;
-        static global_cache = {};
-        cache = {};
+        static global_cache = Object.create(null);
+        cache = Object.create(null);
         constructor(validator) {
             this.validator = validator;
         }
         static cacheSchemaByUri(uri, schema) {
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             if (remotePath) {
                 this.global_cache[remotePath] = schema;
             }
         }
         cacheSchemaByUri(uri, schema) {
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             if (remotePath) {
                 this.cache[remotePath] = schema;
             }
         }
         removeFromCacheByUri(uri) {
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             if (remotePath) {
                 delete this.cache[remotePath];
             }
         }
         checkCacheForUri(uri) {
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             return remotePath ? this.cache[remotePath] != null : false;
         }
         getSchema(report, refOrSchema) {
@@ -791,6 +810,9 @@
             return deepClone(refOrSchema, this.validator.options.maxRecursionDepth);
         }
         fromCache(path) {
+            if (path === '__proto__' || path === 'constructor' || path === 'prototype') {
+                return undefined;
+            }
             let found = this.cache[path];
             if (found) {
                 return found;
@@ -822,7 +844,7 @@
                     }
                 }
             }
-            const remotePath = getRemotePath(uri);
+            const remotePath = getSafeRemotePath(uri);
             const queryPath = getQueryPath(uri);
             let result;
             let resolvedFromAncestor = false;
@@ -4277,7 +4299,9 @@
         }
         const datePart = parts[0];
         const timePart = parts.length === 2 ? parts[1] : undefined;
-        if (!/^(?:\d+Y)?(?:\d+M)?(?:\d+D)?$/.test(datePart)) {
+        // RFC 3339 Appendix A ABNF: dur-year = 1*DIGIT "Y" [dur-month], dur-month = 1*DIGIT "M" [dur-day]
+        // Y can only be followed by M (not D directly), so P1Y2D is invalid
+        if (datePart.length > 0 && !/^(?:\d+Y(?:\d+M(?:\d+D)?)?|\d+M(?:\d+D)?|\d+D)$/.test(datePart)) {
             return false;
         }
         const hasDateComponent = /\d+[YMD]/.test(datePart);
@@ -4286,7 +4310,9 @@
             if (timePart.length === 0) {
                 return false;
             }
-            if (!/^(?:\d+H)?(?:\d+M)?(?:\d+S)?$/.test(timePart)) {
+            // RFC 3339 Appendix A ABNF: dur-hour = 1*DIGIT "H" [dur-minute], dur-minute = 1*DIGIT "M" [dur-second]
+            // H can only be followed by M (not S directly), so PT1H2S is invalid
+            if (!/^(?:\d+H(?:\d+M(?:\d+S)?)?|\d+M(?:\d+S)?|\d+S)$/.test(timePart)) {
                 return false;
             }
             hasTimeComponent = /\d+[HMS]/.test(timePart);
@@ -4303,13 +4329,25 @@
         return /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(input);
     };
     const strictUriValidator = (uri) => typeof uri !== 'string' || isURLModule.default(uri);
+    const hasValidPercentEncoding = (str) => {
+        for (let i = 0; i < str.length; i++) {
+            if (str[i] === '%') {
+                if (i + 2 >= str.length || !/[0-9a-fA-F]/.test(str[i + 1]) || !/[0-9a-fA-F]/.test(str[i + 2])) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    };
     const uriValidator = function (uri) {
         if (typeof uri !== 'string')
             return true;
         // eslint-disable-next-line no-control-regex
         if (/[^\x00-\x7F]/.test(uri))
             return false;
-        const match = uri.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/]*)/);
+        if (!hasValidPercentEncoding(uri))
+            return false;
+        const match = uri.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/?#]*)/);
         if (match) {
             const authority = match[2];
             const atIndex = authority.indexOf('@');
@@ -4319,6 +4357,21 @@
                     return false;
                 }
             }
+            // Validate port: must be numeric
+            let hostPort = atIndex >= 0 ? authority.substring(atIndex + 1) : authority;
+            if (hostPort.startsWith('[')) {
+                const bracketEnd = hostPort.indexOf(']');
+                if (bracketEnd >= 0) {
+                    hostPort = hostPort.substring(bracketEnd + 1);
+                }
+            }
+            const colonIndex = hostPort.lastIndexOf(':');
+            if (colonIndex >= 0) {
+                const port = hostPort.substring(colonIndex + 1);
+                if (port.length > 0 && !/^\d+$/.test(port)) {
+                    return false;
+                }
+            }
         }
         return /^[a-zA-Z][a-zA-Z0-9+.-]*:[^"\\<>^{}^`| ]*$/.test(uri);
     };
@@ -4525,6 +4578,7 @@
         if (needsUnicode) {
             // Try compiling with 'u' flag only
             try {
+                // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
                 const re = new RegExp(pattern, 'u');
                 return { ok: true, value: re };
             }
@@ -4540,6 +4594,7 @@
         }
         else {
             try {
+                // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
                 const re = new RegExp(pattern);
                 return { ok: true, value: re };
             }
@@ -5522,21 +5577,13 @@
                 const result = formatValidatorFn.call(this, json);
                 if (result instanceof Promise) {
                     // Promise-based async
-                    const timeoutMs = Math.min(Math.max(this.options.asyncTimeout || 2000, 0), MAX_ASYNC_TIMEOUT);
                     const promiseResult = result;
                     report.addAsyncTaskWithPath(async (callback) => {
                         try {
-                            const timeoutPromise = new Promise((_, reject) => {
-                                setTimeout(() => reject(new Error('Async timeout')), timeoutMs);
-                            });
-                            const resolved = await Promise.race([promiseResult, timeoutPromise]);
+                            const resolved = await promiseResult;
                             callback(resolved);
                         }
-                        catch (error) {
-                            if (error.message === 'Async timeout') {
-                                // Don't call callback, let global timeout handle it
-                                return;
-                            }
+                        catch (_error) {
                             callback(false);
                         }
                     }, [], function (resolvedResult) {
@@ -6386,6 +6433,14 @@
 
     /** Safely assign a property on `obj`, refusing prototype-polluting keys. */
     function safeSetProperty(obj, key, value) {
+        const unsafeTargets = [
+            Object.prototype,
+            Function.prototype,
+            Array.prototype,
+        ];
+        if (unsafeTargets.includes(obj)) {
+            return;
+        }
         /** Reject property names that could pollute Object.prototype (CWE-1321). */
         if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
             obj[key] = value;
@@ -6628,8 +6683,14 @@
                     this.collectAndCacheIds(schema);
                 }
             }
+            const canMutateSchemaObject = schema !== Object.prototype &&
+                schema !== Function.prototype &&
+                schema !== Array.prototype;
             // if we have an id than it should be cached already (if this instance has compiled it)
-            if (schema.__$compiled && schema.id && this.validator.scache.checkCacheForUri(schema.id) === false) {
+            if (canMutateSchemaObject &&
+                schema.__$compiled &&
+                schema.id &&
+                this.validator.scache.checkCacheForUri(schema.id) === false) {
                 schema.__$compiled = undefined;
             }
             // do not re-compile schemas
@@ -6637,7 +6698,7 @@
                 return true;
             }
             // v8 - if $schema is not present, set $schema to default
-            if (!schema.$schema && this.validator.options.version !== 'none') {
+            if (canMutateSchemaObject && !schema.$schema && this.validator.options.version !== 'none') {
                 schema.$schema = this.validator.getDefaultSchemaId();
             }
             if (schema.id && typeof schema.id === 'string' && !options?.noCache) {
@@ -6652,7 +6713,9 @@
             }
             // delete all __$missingReferences from previous compilation attempts
             const isValidExceptReferences = report.isValid();
-            delete schema.__$missingReferences;
+            if (canMutateSchemaObject) {
+                delete schema.__$missingReferences;
+            }
             // collect all references that need to be resolved - $ref and $schema
             const useRefObjectScope = this.validator.options.version === 'draft2019-09' || this.validator.options.version === 'draft2020-12';
             const refs = collectReferences(schema, undefined, undefined, undefined, { useRefObjectScope }, this.validator.options.maxRecursionDepth);
@@ -6700,7 +6763,7 @@
                         report.addError('UNRESOLVABLE_REFERENCE', [refObj.ref]);
                         report.path = report.path.slice(0, -refObj.path.length);
                         // pusblish unresolved references out
-                        if (isValidExceptReferences) {
+                        if (isValidExceptReferences && canMutateSchemaObject) {
                             schema.__$missingReferences = schema.__$missingReferences || [];
                             schema.__$missingReferences.push(refObj);
                         }
@@ -6710,7 +6773,7 @@
                 safeSetProperty(refObj.obj, `__${refObj.key}Resolved`, response);
             }
             const isValid = report.isValid();
-            if (isValid) {
+            if (isValid && canMutateSchemaObject) {
                 schema.__$compiled = true;
             }
             // else {