networknt / json-schema-validator

A fast Java JSON schema validator that supports draft V4, V6, V7, V2019-09 and V2020-12
Apache License 2.0
855 stars 325 forks source link

JsonSchemaFactory.getSchema() silently mishandles anchor targets. #928

Closed crutcher closed 9 months ago

crutcher commented 9 months ago

This affects JSD $anchor/$id "#target" fragment targets.

JsonSchemaFactory.getSchema("...#target...") silently retrieves the base URI schema.

The cause is this line in getMappedSchema():

JsonNode subSchemaNode = document.getRefSchemaNode(schemaLocation.getFragment().toString());

The returned fragment is passed to getRefSchemaNode() without a # prefix, which prevents it being treated as an anchor reference.

A simple solution appears to be adding "#" + to the call; and that passes all the existing tests. I'm investigating writing a full test for this.