Skip to content

fix: escape schema values in generated code - #878

Open
mcollina wants to merge 2 commits into
mainfrom
fix/schema-code-generation-escaping
Open

fix: escape schema values in generated code#878
mcollina wants to merge 2 commits into
mainfrom
fix/schema-code-generation-escaping

Conversation

@mcollina

@mcollina mcollina commented Sep 5, 2026

Copy link
Copy Markdown
Member

Summary

  • stop embedding schema references directly into generated comments, template literals, validator calls, and regular-expression literals
  • encode complete generated error literals, including required-property errors
  • escape JSON Pointer tokens and URI-fragment characters in generated validator references
  • reject active schema identifiers containing block-comment terminators when Ajv source generation is enabled
  • add regression coverage across normal, debug/restore, standalone, and inline-validator modes

Rationale

The README requires schema definitions to be trusted application code. This change preserves that trust model while ensuring schema-derived strings cannot accidentally change generated JavaScript or resolve to the wrong validator path.

Validation

  • npm test — 514 tests passed; 100% statement, branch, function, and line coverage
  • npm run lint
  • targeted tests on Node.js 20, 22, 24, and 26
  • npm pack --dry-run
  • git diff --check

@mcollina
mcollina force-pushed the fix/schema-code-generation-escaping branch from d3708dd to a3a8092 Compare September 5, 2026 09:42
Comment thread index.js

code += `
if (/${propertyKey.replace(/\\*\//g, '\\/')}/.test(key)) {
if (new RegExp(${JSON.stringify(propertyKey)}).test(key)) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is inside the for (const key of Object.keys(...)) loop, so the RegExp gets constructed once per key per pattern on every serialization. Was that intentional, or worth hoisting it to module scope next to the generated functions?

@gurgunday gurgunday left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants