fix: escape schema values in generated code

Author: mcollina

index.js

@@ -371,7 +371,7 @@ function buildExtraObjectPropertiesSerializer (context, location, addComma, objV
       const propertyLocation = patternPropertiesLocation.getPropertyLocation(propertyKey)
 
       code += `
-        if (/${propertyKey.replace(/\\*\//g, '\\/')}/.test(key)) {
+        if (new RegExp(${JSON.stringify(propertyKey)}).test(key)) {
           ${addComma}
           json += asString(key) + JSON_STR_COLONS
           ${buildValue(context, propertyLocation, 'value')}
@@ -620,10 +620,7 @@ function buildObject (context, location, input) {
     const functionName = generateFuncName(context)
     context.functionsNamesBySchema.set(schema, functionName)
 
-    const schemaRef = getSafeSchemaRef(context, location)
-
     const functionCode = `
-      // ${schemaRef}
       function ${functionName} (input) {
         const obj = ${toJSON('input')}
         if (obj === null) return ${nullable ? 'JSON_STR_NULL' : 'JSON_STR_EMPTY_OBJECT'}
@@ -680,17 +677,17 @@ function buildArray (context, location, input) {
     context.functionsNamesBySchema.set(schema, functionName)
 
     const schemaRef = getSafeSchemaRef(context, location)
+    const schemaRefError = JSON.stringify(`The value of '${schemaRef}' does not match schema definition.`)
 
     let functionCode = `
     function ${functionName} (obj) {
-      // ${schemaRef}
       let json = ''
   `
 
     functionCode += `
     if (obj === null) return ${nullable ? 'JSON_STR_NULL' : 'JSON_STR_EMPTY_ARRAY'}
     if (!Array.isArray(obj)) {
-      throw new TypeError(\`The value of '${schemaRef}' does not match schema definition.\`)
+      throw new TypeError(${schemaRefError})
     }
     const arrayLength = obj.length
   `
@@ -768,14 +765,15 @@ function buildArray (context, location, input) {
   }
 
   context.buildingSet.add(schema)
-  const safeSchemaRef = getSafeSchemaRef(context, location)
+  const schemaRef = getSafeSchemaRef(context, location)
+  const schemaRefError = JSON.stringify(`The value of '${schemaRef}' does not match schema definition.`)
   const objVar = `obj_${context.uid++}`
   let inlinedCode = `
     const ${objVar} = ${input}
     if (${objVar} === null) {
       json += ${nullable ? 'JSON_STR_NULL' : 'JSON_STR_EMPTY_ARRAY'}
     } else if (!Array.isArray(${objVar})) {
-      throw new TypeError(\`The value of '${safeSchemaRef}' does not match schema definition.\`)
+      throw new TypeError(${schemaRefError})
     } else {
       const arrayLength_${objVar} = ${objVar}.length
   `
@@ -976,8 +974,9 @@ function buildMultiTypeSerializer (context, location, input) {
       }
     }
   })
+  const schemaRef = getSafeSchemaRef(context, location)
   code += `
-    else throw new TypeError(\`The value of '${getSafeSchemaRef(context, location)}' does not match schema definition.\`)
+    else throw new TypeError(${JSON.stringify(`The value of '${schemaRef}' does not match schema definition.`)})
   `
 
   return code
@@ -1218,14 +1217,15 @@ function buildOneOf (context, location, input) {
     context.validatorSchemaRefs.add(schemaRef)
 
     code += `
-      ${index === 0 ? 'if' : 'else if'}(validator.validate("${schemaRef}", ${input})) {
+      ${index === 0 ? 'if' : 'else if'}(validator.validate(${JSON.stringify(schemaRef)}, ${input})) {
         ${nestedResult}
       }
     `
   }
 
+  const schemaRef = getSafeSchemaRef(context, location)
   code += `
-    else throw new TypeError(\`The value of '${getSafeSchemaRef(context, location)}' does not match schema definition.\`)
+    else throw new TypeError(${JSON.stringify(`The value of '${schemaRef}' does not match schema definition.`)})
   `
 
   return code
@@ -1268,7 +1268,7 @@ function buildIfThenElse (context, location, input) {
 
   if (!elseSchema) {
     return `
-      if (validator.validate("${ifSchemaRef}", ${input})) {
+      if (validator.validate(${JSON.stringify(ifSchemaRef)}, ${input})) {
         ${buildValue(context, thenMergedLocation, input)}
       } else {
         ${buildValue(context, rootLocation, input)}
@@ -1292,7 +1292,7 @@ function buildIfThenElse (context, location, input) {
   }
 
   return `
-    if (validator.validate("${ifSchemaRef}", ${input})) {
+    if (validator.validate(${JSON.stringify(ifSchemaRef)}, ${input})) {
       ${buildValue(context, thenMergedLocation, input)}
     } else {
       ${buildValue(context, elseMergedLocation, input)}

test/code-generation-fallbacks.test.js

@@ -110,18 +110,20 @@ test('inline array generation without schema IDs', t => {
 })
 
 test('code generation reference fallbacks', t => {
-  t.plan(3)
+  t.plan(4)
 
   const buildWithoutPointer = loadBuildWithLocation(LocationWithoutJsonPointer)
   const stringifyObject = buildWithoutPointer({ type: 'object' })
   const stringifyArray = buildWithoutPointer({ type: 'array' })
 
   const buildWithoutRef = loadBuildWithLocation(LocationWithoutSchemaRef)
-  const stringifyWithoutRef = buildWithoutRef({ type: 'object' })
+  const stringifyObjectWithoutRef = buildWithoutRef({ type: 'object' })
+  const stringifyArrayWithoutRef = buildWithoutRef({ type: 'array' })
 
   t.assert.equal(stringifyObject({}), '{}')
   t.assert.equal(stringifyArray([]), '[]')
-  t.assert.equal(stringifyWithoutRef({}), '{}')
+  t.assert.equal(stringifyObjectWithoutRef({}), '{}')
+  t.assert.equal(stringifyArrayWithoutRef([]), '[]')
 })
 
 test('required-property fallback tolerates unexpected property ordering', t => {

test/code-generation-sanitization.test.js

@@ -0,0 +1,165 @@
+'use strict'
+
+const { test } = require('node:test')
+const build = require('..')
+
+const marker = '__fastJsonStringifyCodeGenerationMarker'
+
+test('schema references with line breaks do not alter generated code', (t) => {
+  t.after(() => {
+    delete globalThis[marker]
+  })
+
+  const objectPropertyName = `nested\n;globalThis.${marker} = true\n//`
+  const arrayPropertyName = `list\n;globalThis.${marker} = true\n//`
+  const input = {
+    [objectPropertyName]: {
+      value: 'safe'
+    },
+    [arrayPropertyName]: ['safe']
+  }
+
+  const stringify = build({
+    type: 'object',
+    properties: {
+      [objectPropertyName]: {
+        type: 'object',
+        properties: {
+          value: { type: 'string' }
+        }
+      },
+      [arrayPropertyName]: {
+        type: 'array',
+        items: { type: 'string' }
+      }
+    }
+  })
+
+  t.assert.equal(globalThis[marker], undefined)
+  const output = stringify(input)
+  t.assert.equal(globalThis[marker], undefined)
+  t.assert.equal(output, JSON.stringify(input))
+})
+
+function testSchemaRefError (name, propertySchema, invalidValue) {
+  test(`schema references are escaped in generated ${name} errors`, (t) => {
+    t.after(() => {
+      delete globalThis[marker]
+    })
+
+    const propertyName = `${name}\`,globalThis.${marker}=true,\``
+    const stringify = build({
+      type: 'object',
+      properties: {
+        [propertyName]: propertySchema
+      }
+    })
+
+    t.assert.throws(
+      () => stringify({ [propertyName]: invalidValue }),
+      new TypeError(`The value of '#/properties/${propertyName}' does not match schema definition.`)
+    )
+    t.assert.equal(globalThis[marker], undefined)
+  })
+}
+
+testSchemaRefError('array', {
+  type: 'array',
+  items: { type: 'string' }
+}, 'not an array')
+
+testSchemaRefError('multi-type', {
+  type: ['string', 'number']
+}, {})
+
+testSchemaRefError('anyOf', {
+  anyOf: [
+    { type: 'string' },
+    { type: 'number' }
+  ]
+}, false)
+
+test('pattern property expressions are preserved in generated code', (t) => {
+  const newlinePattern = '^line\nbreak$'
+  const slashPattern = '^backslash\\\\/$'
+  const stringify = build({
+    type: 'object',
+    patternProperties: {
+      [newlinePattern]: { type: 'string' },
+      [slashPattern]: { type: 'string' }
+    }
+  })
+
+  const input = {
+    'line\nbreak': 'newline',
+    'backslash\\/': 'slash',
+    'backslash/': 'does not match'
+  }
+
+  t.assert.equal(stringify(input), '{"line\\nbreak":"newline","backslash\\\\/":"slash"}')
+})
+
+test('quoted external schema ids are escaped in anyOf validator calls', (t) => {
+  const stringSchemaId = 'external"string'
+  const numberSchemaId = 'external"number'
+  const stringify = build({
+    anyOf: [
+      { $ref: `${stringSchemaId}#` },
+      { $ref: `${numberSchemaId}#` }
+    ]
+  }, {
+    schema: {
+      stringSchema: {
+        $id: stringSchemaId,
+        type: 'string'
+      },
+      numberSchema: {
+        $id: numberSchemaId,
+        type: 'number'
+      }
+    }
+  })
+
+  t.assert.equal(stringify('safe'), '"safe"')
+  t.assert.equal(stringify(42), '42')
+})
+
+test('quoted external schema ids are escaped in if validator calls', (t) => {
+  const schemaId = 'condition"schema'
+  const thenSchema = {
+    properties: {
+      value: { type: 'string' }
+    }
+  }
+  const options = {
+    schema: {
+      condition: {
+        $id: schemaId,
+        type: 'object',
+        properties: {
+          kind: { const: 'string' }
+        },
+        required: ['kind']
+      }
+    }
+  }
+  const stringify = build({
+    type: 'object',
+    if: { $ref: `${schemaId}#` },
+    then: thenSchema,
+    else: {
+      properties: {
+        value: { type: 'number' }
+      }
+    }
+  }, options)
+  const stringifyWithoutElse = build({
+    type: 'object',
+    if: { $ref: `${schemaId}#` },
+    then: thenSchema
+  }, options)
+
+  t.assert.equal(stringify({ kind: 'string', value: 'safe' }), '{"value":"safe"}')
+  t.assert.equal(stringify({ kind: 'number', value: 42 }), '{"value":42}')
+  t.assert.equal(stringifyWithoutElse({ kind: 'string', value: 'safe' }), '{"value":"safe"}')
+})