Skip to content

Commit f3a358e

Browse files
authored
More schema hardening (#105)
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
1 parent 7b9b6f8 commit f3a358e

64 files changed

Lines changed: 294 additions & 123 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"$schema": "https://json-schema.org/draft/2020-12/schema",
3-
"title": "IEEE Std 1003.1-2017 POSIX File Path)",
3+
"title": "IEEE Std 1003.1-2017 POSIX File Path",
44
"description": "IEEE Std 1003.1-2017 POSIX pathname",
55
"examples": [
66
"/",
@@ -12,17 +12,9 @@
1212
],
1313
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",
1414
"x-links": [ "https://pubs.opengroup.org/onlinepubs/9699919799/" ],
15-
"anyOf": [
16-
{
17-
"$ref": "./path-absolute.json"
18-
},
19-
{
20-
"$ref": "./path-relative.json"
21-
},
22-
{
23-
"$comment": "A pathname beginning with exactly two slashes is a valid pathname with implementation-defined interpretation, though not an Absolute Pathname",
24-
"type": "string",
25-
"pattern": "^//([^/].*)?$"
26-
}
27-
]
15+
"type": "string",
16+
"not": {
17+
"$comment": "Cannot contain null bytes",
18+
"pattern": "\u0000"
19+
}
2820
}

schemas/2020-12/ietf/encoding/base16.json

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,6 @@
1313
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",
1414
"x-links": [ "https://www.rfc-editor.org/rfc/rfc4648.html#section-8" ],
1515
"type": "string",
16-
"not": {
17-
"pattern": "[\\x00-\\x1F]"
18-
},
1916
"pattern": "^([0-9A-Fa-f]{2})*$",
2017
"contentEncoding": "base16"
2118
}

schemas/2020-12/ietf/http/method.json

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,5 @@
66
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",
77
"x-links": [ "https://www.rfc-editor.org/rfc/rfc9110#section-9" ],
88
"type": "string",
9-
"not": {
10-
"pattern": "[\\x00-\\x1F\\x7F]"
11-
},
129
"pattern": "^[!#$%&'*+\\-.0-9A-Z^_`a-z|~]+$"
1310
}

schemas/2020-12/ietf/language/3066/tag-syntax.json

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,5 @@
1919
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",
2020
"x-links": [ "https://www.rfc-editor.org/rfc/rfc3066.html" ],
2121
"type": "string",
22-
"not": {
23-
"$comment": "Cannot contain whitespace or control characters",
24-
"pattern": "[\\s]"
25-
},
2622
"pattern": "^[a-zA-Z]{1,8}(-[a-zA-Z0-9]{1,8})*$"
2723
}

schemas/2020-12/ietf/uri/url.json

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
"$schema": "https://json-schema.org/draft/2020-12/schema",
33
"title": "RFC 3986 Uniform Resource Locator (URL)",
44
"description": "A locatable absolute Uniform Resource Identifier (URI)",
5+
"$comment": "Given the referenced URI schema, a locator is exactly a URI whose character after the scheme colon is a slash, question mark, hash, or the end of the string",
56
"examples": [
67
"https://example.com/path/to/resource?query=value#section",
78
"http://user:pass@192.168.1.1:8080/api/v1",
@@ -12,17 +13,5 @@
1213
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",
1314
"x-links": [ "https://www.rfc-editor.org/rfc/rfc3986#section-3" ],
1415
"$ref": "./uri.json",
15-
"anyOf": [
16-
{
17-
"$comment": "With authority",
18-
"pattern": "^[A-Za-z][A-Za-z0-9+\\-.]*://"
19-
},
20-
{
21-
"$comment": "Rootless-path URIs such as mailto and urn are not syntactically distinguishable as locators, so only path-absolute and empty paths qualify",
22-
"not": {
23-
"pattern": "^[^:]+://"
24-
},
25-
"pattern": "^[A-Za-z][A-Za-z0-9+\\-.]*:(?:/[^?#]*)?(?:\\?[^#]*)?(?:#.*)?$"
26-
}
27-
]
16+
"pattern": "^[A-Za-z][A-Za-z0-9+\\-.]*:(?:[/?#]|$)"
2817
}

schemas/2020-12/ietf/uri/urn.json

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,10 @@
1717
"urn:example:foo/bar/"
1818
],
1919
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",
20-
"x-links": [ "https://www.rfc-editor.org/rfc/rfc8141#section-2" ],
20+
"x-links": [
21+
"https://www.rfc-editor.org/rfc/rfc8141#section-2",
22+
"https://www.rfc-editor.org/rfc/rfc2141#section-2.1"
23+
],
2124
"$ref": "./uri.json",
2225
"not": {
2326
"$comment": "Disallow reserved NID value 'urn'",

schemas/2020-12/iso/currency/2015/historical/alpha-code.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"$schema": "https://json-schema.org/draft/2020-12/schema",
3-
"title": "ISO 4217:2015 Alphabetic Currency and Precious Metal Code (Historical)",
4-
"description": "A three-letter alphabetic code including withdrawn currencies and precious metals (2025-03-31)",
3+
"title": "ISO 4217:2015 Alphabetic Currency Code (Historical)",
4+
"description": "A three-letter alphabetic code including withdrawn currencies (2025-03-31)",
55
"examples": [ "ADP", "AFA", "ALK", "ANG" ],
66
"deprecated": true,
77
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",

schemas/2020-12/iso/currency/2015/historical/numeric-code.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"$schema": "https://json-schema.org/draft/2020-12/schema",
3-
"title": "ISO 4217:2015 Numeric Currency and Precious Metal Code (Historical)",
4-
"description": "A three-digit numeric code including withdrawn currencies and precious metals (2025-03-31)",
3+
"title": "ISO 4217:2015 Numeric Currency Code (Historical)",
4+
"description": "A three-digit numeric code including withdrawn currencies (2025-03-31)",
55
"examples": [ 4, 8, 20, 24 ],
66
"deprecated": true,
77
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",

schemas/2020-12/iso/datetime/2019/date/calendar-extended.json

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
{
2-
"$schema": "https://json-schema.org/draft/2020-12/schema",
2+
"$schema": "urn:sourcemeta:std:ietf:jsonschema:2020-12:dialect:format-assertion",
33
"title": "ISO 8601-1:2019 Calendar Date (Extended Format)",
44
"description": "A complete representation of a calendar date in extended format [YYYY][\"-\"][MM][\"-\"][DD] (§5.2.2.1 b)",
5-
"$comment": "This schema validates day/month combinations (i.e rejects April 31) but does not validate leap years. February 29 is accepted for any year, and leap year validation must be performed by the consumer",
65
"examples": [
76
"1985-04-12",
87
"2000-01-01",
@@ -14,5 +13,5 @@
1413
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",
1514
"x-links": [ "https://www.iso.org/standard/70907.html" ],
1615
"type": "string",
17-
"pattern": "^([0-9]{4}-(0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|[0-9]{4}-(0[469]|11)-(0[1-9]|[12][0-9]|30)|[0-9]{4}-02-(0[1-9]|1[0-9]|2[0-9]))$"
16+
"format": "date"
1817
}

schemas/2020-12/iso/datetime/2019/duration/ordinal-basic.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,10 @@
22
"$schema": "https://json-schema.org/draft/2020-12/schema",
33
"title": "ISO 8601-1:2019 Duration (Alternative Ordinal Basic Format)",
44
"description": "A duration in alternative basic format with ordinal date P[YYYYDDD]T[HHMMSS] (§5.5.2.4)",
5+
"$comment": "Alternative-format durations are quantities, not dates: the day field is capped at its carry-over point and years are unsigned",
56
"examples": [ "P0002178T223355", "P0001001T000000", "P0001365T235959" ],
67
"x-license": "https://github.com/sourcemeta/std/blob/main/LICENSE",
78
"x-links": [ "https://www.iso.org/standard/70907.html" ],
89
"type": "string",
9-
"pattern": "^P(?:[0-9]{4}|[+-][0-9]{5,})(?:0[0-9][1-9]|0[1-9][0-9]|[12][0-9]{2}|3[0-5][0-9]|36[0-6])T(?:[01][0-9]|2[0-3])(?:[0-5][0-9])(?:[0-5][0-9])$"
10+
"pattern": "^P[0-9]{4}(?:[0-2][0-9]{2}|3[0-5][0-9]|36[0-5])T(?:[01][0-9]|2[0-3])(?:[0-5][0-9])(?:[0-5][0-9])$"
1011
}

0 commit comments

Comments
 (0)