Skip to content

Note undefined behavior with unknown $ref targets #713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 20, 2019
Merged

Note undefined behavior with unknown $ref targets #713

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
56c2271
Note undefined behavior with unknown $ref targets
handrews Feb 23, 2019
e741b8e
Clarify non-schema $ref targets
handrews Mar 4, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions jsonschema-core.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1540,6 +1540,41 @@
</t>
</section>

<section title="References to Possible Non-Schemas">
<t>
Subschema objects (or booleans) are recognized by their use with known
applicator keywords. These keywords may be the standard applicators
from this document, or extension keywords from a known vocabulary, or
implementation-specific custom keywords.
</t>
<t>
Multi-level structures of unknown keywords are capable of introducing
nested subschemas, which would be subject to the processing rules for
"$id". Therefore, having a reference target in such an unrecognized
structure cannot be reliably implemented, and the resulting behavior
is undefined. Similarly, a reference target under a known keyword,
for which the value is known not to be a schema, results in undefined
behavior in order to avoid burdening implementations with the need
to detect such targets.
<cref>
These scenarios are analogous to fetching a schema over HTTP
but receiving a response with a Content-Type other than
application/schema+json. An implementation can certainly
try to interpret it as a schema, but the origin server
offered no guarantee that it actually is any such thing.
Therefore, interpreting it as such has security implications
and may produce unpredictable results.
</cref>
</t>
<t>
Note that single-level custom keywords with identical syntax and
semantics to "$defs" do not allow for any intervening "$id" keywords,
and therefore will behave correctly under implementations that attempt
to use any reference target as a schema. However, this behavior is
implementation-specific and MUST NOT be relied upon for interoperability.
</t>
</section>

<section title="Loading a referenced schema">
<t>
The use of URIs to identify remote schemas does not necessarily mean anything is downloaded,
Expand Down
5 changes: 3 additions & 2 deletions jsonschema-validation.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -887,8 +887,9 @@
</artwork>
<postamble>
Instances described by this schema should be strings containing HTML, using
whatever character set the JSON string was decoded into (default is
Unicode).
whatever character set the JSON string was decoded into. Per section 8.1 of
<xref target="RFC8259">RFC 8259</xref>, outside of an entirely closed
system, this MUST be UTF-8.
</postamble>
</figure>

Expand Down