Skip to content

Commit cad29ac

Browse files
committed
Collect unknown keywords as annotations
And try to avoid memory exhaustion attacks, which were possible even with out this change but potentially more likely to happen by accident with it (e.g. unrecognized applicator with a very large subschema).
1 parent d432786 commit cad29ac

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

jsonschema-core.xml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -351,7 +351,7 @@
351351
</t>
352352
<t>
353353
A JSON Schema MAY contain properties which are not schema keywords.
354-
Unknown keywords SHOULD be ignored.
354+
Unknown keywords SHOULD be treated as annotations.
355355
</t>
356356
<t>
357357
An empty schema is a JSON Schema with no properties, or only unknown
@@ -3090,6 +3090,11 @@ https://example.com/schemas/common#/$defs/count/minimum
30903090
system resources.
30913091
Validators MUST NOT fall into an infinite loop.
30923092
</t>
3093+
<t>
3094+
A malicious party could cause an implementation to repeatedly collect a copy
3095+
of a very large value as an annotation. Implementations SHOULD guard against
3096+
excessive consumption of system resources in such a scenario.
3097+
</t>
30933098
<t>
30943099
Servers MUST ensure that malicious parties can't change the functionality of
30953100
existing schemas by uploading a schema with a pre-existing or very similar "$id".

0 commit comments

Comments
 (0)