Skip to content

fix: limit schema compilation depth - #874

Open
mcollina wants to merge 1 commit into
mainfrom
fix/schema-depth-stack-exhaustion
Open

fix: limit schema compilation depth#874
mcollina wants to merge 1 commit into
mainfrom
fix/schema-depth-stack-exhaustion

Conversation

@mcollina

Copy link
Copy Markdown
Member

Summary

  • reject excessively nested schemas before recursive validation and code generation
  • apply depth accounting to inline, external, and reference-linked schemas, including validator-only keywords
  • detect circular object/reference graphs deterministically and walk validator dependencies iteratively
  • expose and document a bounded maxDepth option (default and maximum: 100)

Security

Fixes stack exhaustion during schema compilation reported in GHSA-2CPC-HGRF-32M6.

Validation

  • npm test (513 tests, 100% statement/branch/function/line coverage)
  • npm run lint
  • npm run test:typescript
  • reproduced the 718-level advisory PoC and confirmed it returns a controlled depth error instead of RangeError
  • exercised the highest accepted depth and first rejected depth across inline/reference-linked and eager/lazy validator paths

@Tony133 Tony133 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants