Skip to content

Reject invalid anchors in Draft 7 and older #2366

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jviotti merged 1 commit into from
Apr 30, 2026
Merged

Reject invalid anchors in Draft 7 and older #2366

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 19 additions & 5 deletions src/core/jsonschema/frame.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ auto is_valid_anchor_2020_12(const std::string_view name) -> bool {
return true;
}

auto is_valid_anchor_2019_09(const std::string_view name) -> bool {
auto is_valid_anchor(const std::string_view name) -> bool {
if (name.empty()) {
return false;
}
Expand Down Expand Up @@ -135,7 +135,7 @@ auto find_anchors(const sourcemeta::core::JSON &schema,
const auto *anchor_2019{schema.try_at("$anchor")};
if (anchor_2019 && anchor_2019->is_string()) {
const std::string_view anchor_view{anchor_2019->to_string()};
if (!is_valid_anchor_2019_09(anchor_view)) {
if (!is_valid_anchor(anchor_view)) {
throw sourcemeta::core::SchemaKeywordError("$anchor", anchor_view,
"Invalid anchor value");
}
Expand Down Expand Up @@ -168,8 +168,16 @@ auto find_anchors(const sourcemeta::core::JSON &schema,
// A bare "#" carries no anchor name, so we treat it as no anchor at
// all.
if (id_view.starts_with('#') && id_view.size() > 1) {
// The original string is "#fragment", skip the '#'
result.emplace_back(id_view.substr(1), AnchorType::Static);
const std::string_view anchor_view{id_view.substr(1)};
// Per Draft 7 / 6 spec, the plain-name fragment in `$id` must
// begin with a letter `[A-Za-z]` followed by any number of
// letters, digits, hyphens, underscores, colons, or periods.
if (!is_valid_anchor(anchor_view)) {
throw sourcemeta::core::SchemaKeywordError("$id", id_view,
"Invalid anchor value");
}

result.emplace_back(anchor_view, AnchorType::Static);
}
}
}
Expand All @@ -186,7 +194,13 @@ auto find_anchors(const sourcemeta::core::JSON &schema,
// A bare "#" carries no anchor name, so we treat it as no anchor at
// all.
if (id_view.starts_with('#') && id_view.size() > 1) {
// The original string is "#fragment", skip the '#'
// Draft 4 imposes no plain-name pattern on the fragment, but the
// value must still be a valid URI reference per RFC 3986
if (!sourcemeta::core::URI::is_uri_reference(id_view)) {
throw sourcemeta::core::SchemaKeywordError(
"id", id_view, "The identifier is not a valid URI");
}

result.emplace_back(id_view.substr(1), AnchorType::Static);
}
}
Expand Down
41 changes: 41 additions & 0 deletions test/jsonschema/jsonschema_frame_draft3_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -901,3 +901,44 @@ TEST(JSONSchema_frame_draft3, top_level_id_empty_string) {

EXPECT_FRAME_LOCATION_REACHABLE(frame, Static, "", frame.root());
}

TEST(JSONSchema_frame_draft3, id_fragment_rejected) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"id": "#foo",
"$schema": "http://json-schema.org/draft-03/schema#"
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaFrameError &error) {
EXPECT_EQ(error.identifier(), "#foo");
} catch (...) {
FAIL();
}
}

TEST(JSONSchema_frame_draft3, id_fragment_invalid_whitespace) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"id": "#foo bar",
"$schema": "http://json-schema.org/draft-03/schema#"
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "id");
EXPECT_EQ(error.value(), "#foo bar");
} catch (...) {
FAIL();
}
}
50 changes: 50 additions & 0 deletions test/jsonschema/jsonschema_frame_draft4_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1378,3 +1378,53 @@ TEST(JSONSchema_frame_draft4, top_level_id_empty_string) {

EXPECT_FRAME_LOCATION_REACHABLE(frame, Static, "", frame.root());
}

TEST(JSONSchema_frame_draft4, id_fragment_invalid_whitespace) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"$schema": "http://json-schema.org/draft-04/schema#",
"definitions": {
"foo": {
"id": "#foo bar"
}
}
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "id");
EXPECT_EQ(error.value(), "#foo bar");
} catch (...) {
FAIL();
}
}

TEST(JSONSchema_frame_draft4, id_fragment_invalid_angle_bracket) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"$schema": "http://json-schema.org/draft-04/schema#",
"definitions": {
"foo": {
"id": "#foo<bar"
}
}
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "id");
EXPECT_EQ(error.value(), "#foo<bar");
} catch (...) {
FAIL();
}
}
75 changes: 75 additions & 0 deletions test/jsonschema/jsonschema_frame_draft6_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1328,3 +1328,78 @@ TEST(JSONSchema_frame_draft6, top_level_id_empty_string) {

EXPECT_FRAME_LOCATION_REACHABLE(frame, Static, "", frame.root());
}

TEST(JSONSchema_frame_draft6, id_fragment_invalid_leading_digit) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"$schema": "http://json-schema.org/draft-06/schema#",
"definitions": {
"foo": {
"$id": "#1foo"
}
}
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "$id");
EXPECT_EQ(error.value(), "#1foo");
} catch (...) {
FAIL();
}
}

TEST(JSONSchema_frame_draft6, id_fragment_invalid_punctuation) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"$schema": "http://json-schema.org/draft-06/schema#",
"definitions": {
"foo": {
"$id": "#foo!"
}
}
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "$id");
EXPECT_EQ(error.value(), "#foo!");
} catch (...) {
FAIL();
}
}

TEST(JSONSchema_frame_draft6, id_fragment_invalid_leading_underscore) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"$schema": "http://json-schema.org/draft-06/schema#",
"definitions": {
"foo": {
"$id": "#_foo"
}
}
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "$id");
EXPECT_EQ(error.value(), "#_foo");
} catch (...) {
FAIL();
}
}
100 changes: 100 additions & 0 deletions test/jsonschema/jsonschema_frame_draft7_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1322,3 +1322,103 @@ TEST(JSONSchema_frame_draft7, top_level_id_empty_string) {

EXPECT_FRAME_LOCATION_REACHABLE(frame, Static, "", frame.root());
}

TEST(JSONSchema_frame_draft7, id_fragment_invalid_leading_digit) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"foo": {
"$id": "#1foo"
}
}
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "$id");
EXPECT_EQ(error.value(), "#1foo");
} catch (...) {
FAIL();
}
}

TEST(JSONSchema_frame_draft7, id_fragment_invalid_punctuation) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"foo": {
"$id": "#foo!"
}
}
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "$id");
EXPECT_EQ(error.value(), "#foo!");
} catch (...) {
FAIL();
}
}

TEST(JSONSchema_frame_draft7, id_fragment_invalid_at_sign) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"foo": {
"$id": "#foo@bar"
}
}
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "$id");
EXPECT_EQ(error.value(), "#foo@bar");
} catch (...) {
FAIL();
}
}

TEST(JSONSchema_frame_draft7, id_fragment_invalid_leading_underscore) {
const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"foo": {
"$id": "#_foo"
}
}
})JSON");

sourcemeta::core::SchemaFrame frame{
sourcemeta::core::SchemaFrame::Mode::References};

try {
frame.analyse(document, sourcemeta::core::schema_walker,
sourcemeta::core::schema_resolver);
FAIL();
} catch (const sourcemeta::core::SchemaKeywordError &error) {
EXPECT_EQ(error.keyword(), "$id");
EXPECT_EQ(error.value(), "#_foo");
} catch (...) {
FAIL();
}
}
Loading