networknt / json-schema-validator

A fast Java JSON schema validator that supports draft V4, V6, V7, V2019-09 and V2020-12
Apache License 2.0
800 stars 320 forks source link

[Bug] IRI References with URL encoded '[' and ']' incorrectly fail validation #1050

Closed 4naesthetic closed 1 month ago

4naesthetic commented 1 month ago

IRIs containing %-encoded [ and ] characters incorrectly fail validation due to the following code in the IriFormat and IriReference introduced in #983:

https://github.com/networknt/json-schema-validator/blob/772832511a9c495ebe6c9ec8908e5505da815e73/src/main/java/com/networknt/schema/format/IriReferenceFormat.java#L17-L23

uri.getQuery() decodes the query string, so this scenario fails validation even though [ and ] were correctly escaped. Potentially could use uri.getRawQuery() instead. This wasn't picked up in the original PR as there was no test case written that would pass when these characters were escaped, only that they were disallowed.

Additional test case that demonstrates the issue:

@Test
void queryWithEncodedBracketsShouldPass() {
    String schemaData = "{\r\n"
            + "  \"format\": \"iri-reference\"\r\n"
            + "}";

    SchemaValidatorsConfig config = new SchemaValidatorsConfig();
    config.setFormatAssertionsEnabled(true);
    JsonSchema schema = JsonSchemaFactory.getInstance(VersionFlag.V202012).getSchema(schemaData, config);
    Set<ValidationMessage> messages = schema.validate("\"https://test.com/assets/product.pdf?filter%5Btest%5D=1\"",
            InputFormat.JSON);
    assertTrue(messages.isEmpty()); // Fails
}

Test file references:

justin-tay commented 1 month ago

Thanks for the bug report and fix.