diff --git a/jsonschema-core.xml b/jsonschema-core.xml
index 6288e746..2565169a 100644
--- a/jsonschema-core.xml
+++ b/jsonschema-core.xml
@@ -150,9 +150,9 @@
JSON Schema can be extended either by defining additional vocabularies,
or less formally by defining additional keywords outside of any vocabulary.
- Unrecognized individual keywords are ignored, while the behavior with respect
- to an unrecognized vocabulary can be controlled when declaring which
- vocabularies are in use.
+ Unrecognized individual keywords simply have their values collected as annotations,
+ while the behavior with respect to an unrecognized vocabulary can be controlled
+ when declaring which vocabularies are in use.
This document defines a core vocabulary that MUST be supported by any
@@ -351,7 +351,8 @@
A JSON Schema MAY contain properties which are not schema keywords.
- Unknown keywords SHOULD be ignored.
+ Unknown keywords SHOULD be treated as annotations, where the value
+ of the keyword is the value of the annotation.
An empty schema is a JSON Schema with no properties, or only unknown
@@ -575,7 +576,8 @@
by any entity. Save for explicit agreement, schema authors SHALL NOT
expect these additional keywords and vocabularies to be supported by
implementations that do not explicitly document such support.
- Implementations SHOULD ignore keywords they do not support.
+ Implementations SHOULD treat keywords they do not support as annotations,
+ where the value of the keyword is the value of the annotation.
Implementations MAY provide the ability to register or load handlers
@@ -1237,7 +1239,8 @@
Per , unrecognized
- keywords SHOULD be ignored. This remains the case for keywords defined
+ keywords SHOULD be treated as annotations.
+ This remains the case for keywords defined
by unrecognized vocabularies. It is not currently possible to distinguish
between unrecognized keywords that are defined in vocabularies from
those that are not part of any vocabulary.
@@ -3090,6 +3093,11 @@ https://example.com/schemas/common#/$defs/count/minimum
system resources.
Validators MUST NOT fall into an infinite loop.
+
+ A malicious party could cause an implementation to repeatedly collect a copy
+ of a very large value as an annotation. Implementations SHOULD guard against
+ excessive consumption of system resources in such a scenario.
+
Servers MUST ensure that malicious parties can't change the functionality of
existing schemas by uploading a schema with a pre-existing or very similar "$id".