Skip to content

Commit b13df46

Browse files
committed
Collect unknown keywords as annotations
And try to avoid memory exhaustion attacks, which were possible even with out this change but potentially more likely to happen by accident with it (e.g. unrecognized applicator with a very large subschema).
1 parent 3f1b1c4 commit b13df46

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

jsonschema-core.xml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -342,7 +342,7 @@
342342
</t>
343343
<t>
344344
A JSON Schema MAY contain properties which are not schema keywords.
345-
Unknown keywords SHOULD be ignored.
345+
Unknown keywords SHOULD be treated as annotations.
346346
</t>
347347
<t>
348348
An empty schema is a JSON Schema with no properties, or only unknown
@@ -3036,6 +3036,11 @@ https://example.com/schemas/common#/$defs/count/minimum
30363036
system resources.
30373037
Validators MUST NOT fall into an infinite loop.
30383038
</t>
3039+
<t>
3040+
A malicious party could cause an implementation to repeatedly collect a copy
3041+
of a very large value as an annotation. Implementations SHOULD guard against
3042+
excessive consumption of system resources in such a scenario.
3043+
</t>
30393044
<t>
30403045
Servers MUST ensure that malicious parties can't change the functionality of
30413046
existing schemas by uploading a schema with a pre-existing or very similar "$id".

0 commit comments

Comments
 (0)