Schema builder is mutating schemas

[jsumners]

🐛 Bug Report

After a route is added a function afterRouteAdded is invoked which in turn invokes validation.build => schemas.getSchemaAnyway (via schema.resolveRefs) to build out schemas. This getSchemaAnyway function is injecting new properties into the schema object before passing the schema to the defined schema compiler. If said schema compiler does not recognize these newly added properties then it can fail to return a compiled schema that will validate as expected.

fastify/lib/schemas.js

Lines 121 to 126 in 9b233e8

	if (!schema.type || !schema.properties) {
	return {
	type: 'object',
	properties: schema
	}
	}

To Reproduce

Let's say you use Joi schemas and that your have a custom Joi schema compiler that recognizes some internal extensions to Joi. If you define a route like:

const route = {
  path: '/foo/:an_id',
  schema: {
    params: {
      an_id: joi.number()
    }
  },
  handler(req, res) {
    assert.deepStrictEqual(req.params, {an_id: 42})
    res.send({hello: 'world'})
  }
}

Then a request to /foo/42 will fail the assertion because the custom compiler will return a schema that does not recognize any properties in the param schema due to the extra data being inserted by getSchemaAnyway.

Expected behavior

getSchemaAnyway should not mutate schema definitions it does not recognize.

Your Environment

• node version: 10
• fastify version: >=2.6.0
• os: Mac

[jsumners]

Replication:

'use strict';

const joi = require('@hapi/joi');
const fastify = require('fastify')();

function schemaCompiler(schema) {
  return (data, opts) => joi.validate(data, schema);
}

fastify.setSchemaCompiler(schemaCompiler);

fastify.route({
  path: '/foo/:an_id',
  method: 'GET',
  schema: {
    params: {
      an_id: joi.number()
    }
  },
  handler(req, res) {
    res.send(req.params);
  }
});

fastify.inject({ url: '/foo/42' }, (err, result) => {
  console.log(result.payload);
});

[jsumners]

Note that this reproduction script works under Fastify v1.14.6 without any changes.

[jsumners]

Commit 4c4f775 is the one that introduces the bug.

[jsumners]

Fixed in #1768