Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improper handling of subschema validation in unevaluatedProperties. #421

Closed
tobz opened this issue Mar 21, 2023 · 0 comments · Fixed by #423
Closed

Improper handling of subschema validation in unevaluatedProperties. #421

tobz opened this issue Mar 21, 2023 · 0 comments · Fixed by #423

Comments

@tobz
Copy link
Contributor

tobz commented Mar 21, 2023

As part of #419, I chose to make the subschema subvalidator function on a first-match-found basis, such that if you have a oneOf with multiple subschemas, the first subschema found that would theoretically evaluate the property at all is the result chosen for the overall validate/apply call on the subvalidator.

However, this is wrong, and leads to unintuitive errors in certain cases. For example, if the schema has oneOf where all subschemas are object schemas with a single, identical property, but differing values ("const": "<value>", in my case), then validating that property against any of the subschemas would theoretically result in an application that gave back a result -- because the schema does care about the property -- but may or may not fail depending on the order of the subschemas, and the intended subschema being checked first or not.

In general, we should be obeying the specific behaviors of the given subschema validation mode: continuing with the oneOf example, we should be checking all subschemas, and ensuring that only one of them that indicated that it evaluated the property was in fact valid. Similarly, behavior for allOf and anyOf would need to modeled with their respective constraints.

I'm going to work on a PR to do the aforementioned changes -- treat each subschema validation type (oneOf, etc) distinctly -- along with unit tests, now that I can see that I need to be more deliberate about ensuring that validator conforms to the behavior outlined in the specification. This is, I believe, a consequence of the design I implemented -- checking property evaluation directly rather than collecting annotations at the end, like most third-party validators seem to do -- but I do still think it can fixed without much effort and in a clean and internally consistent way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant