feat: harden schema validators

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Author: jkowalleck

src/_optPlug.node/__jsonValidators/ajv.ts

@@ -27,13 +27,16 @@ import addFormats2019 from 'ajv-formats-draft2019'
 import type { ValidationError } from '../../validation/types'
 import type { Functionality, Validator } from '../jsonValidator'
 
-const ajvOptions: AjvOptions = Object.freeze({
+const ajvOptions: Readonly<AjvOptions> = Object.freeze({
   // no defaults => no data alteration
   useDefaults: false,
   strict: false,
   strictSchema: false,
-  addUsedSchema: false
-})
+  addUsedSchema: false,
+  loadSchema: (uri: string) => {
+    throw new Error(`Remote schemas are disabled: ${uri}`);
+  }
+} satisfies AjvOptions)
 
 /** @internal */
 export default (async function (schemaPath: string, schemaMap: Record<string, string> = {}): Promise<Validator> {

src/_optPlug.node/__xmlValidators/libxmljs2.ts

@@ -34,7 +34,7 @@ const xmlParseOptions: Readonly<ParserOptions> = Object.freeze({
   // see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
   noent: false,
   dtdload: false
-})
+} satisfies ParserOptions)
 
 /** @internal */
 export default (async function (schemaPath: string): Promise<Validator> {