search

cvent / json-schema-deref-sync

Synchronous json schema dereference utility
http://bojand.github.io/json-schema-deref-sync
MIT License
35 stars 24 forks source link

Unintended sideeffects by mutating objects #30

Closed simonmeusel closed 4 years ago

simonmeusel commented 5 years ago

Version: https://github.com/cvent/json-schema-deref-sync/commit/e5989fddb022a827feb51baf8451862172c1cc8c

When multiple schemas are referencing the same value in the internal cache of this package, it might still happen that the reference from the cache gets mutated. Since multiple schemas might use that reference, this can have unintended side effects. It can thus happen, that adding a schema can modify references in other schemas, for example when using the removeIds option.

Mutations could also arise from the mergeAdditionalProperties option, or (maybe) from resolving sub-references.

If have done some work to fix this here, but that seems to break one test with checking for circular references: https://github.com/cvent/json-schema-deref-sync/compare/master...simonmeusel:patch-fix-cache-side-effects-1

In this package we use deep cloning to prevent mutations from having unintended side effects.

Furthermore the https://www.npmjs.com/package/clone package has a

XSS vulnerability detected

on it's page.

EDIT: This issue was most likely not introduced in the latest version. The version note was for the issue template.

jcurtis commented 5 years ago

The only change in 0.11.0 is from this PR https://github.com/cvent/json-schema-deref-sync/pull/27

cc @kobik

simonmeusel commented 5 years ago

I think this issue does not just occur in 0.12.0 but also in earlier versions, but I did not test it.

jcurtis commented 5 years ago

Ah okay, I misunderstood. I thought you meant the latest version introduced this issue.