Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Commit 27cc759

Browse files
Merge pull request #1296 from handrews/no-auto-content
Disallow even optional "content*" processing and validation
2 parents fb39810 + e7d36b2 commit 27cc759

File tree

1 file changed

+6
-26
lines changed

1 file changed

+6
-26
lines changed

‎jsonschema-validation.xml

Lines changed: 6 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -889,42 +889,21 @@
889889
<t>
890890
Due to security and performance concerns, as well as the open-ended nature of
891891
possible content types, implementations MUST NOT automatically decode, parse,
892-
and/or validate the string contents by default. This additionally supports
893-
the use case of embedded documents intended for processing by a different
894-
consumer than that which processed the containing document.
892+
and/or validate the string contents. Applications are expected to use these
893+
annotations to invoke the appropriate libraries separately.
895894
</t>
896895
<t>
897896
All keywords in this section apply only to strings, and have no
898897
effect on other data types.
899898
</t>
900-
<t>
901-
Implementations MAY offer the ability to decode, parse, and/or validate
902-
the string contents automatically. However, it MUST NOT perform these
903-
operations by default, and MUST provide the validation result of each
904-
string-encoded document separately from the enclosing document. This
905-
process SHOULD be equivalent to fully evaluating the instance against
906-
the original schema, followed by using the annotations to decode, parse,
907-
and/or validate each string-encoded document.
908-
<cref>
909-
For now, the exact mechanism of performing and returning parsed
910-
data and/or validation results from such an automatic decoding, parsing,
911-
and validating feature is left unspecified. Should such a feature
912-
prove popular, it may be specified more thoroughly in a future draft.
913-
</cref>
914-
</t>
915-
<t>
916-
See also the <xref target="security">Security Considerations</xref>
917-
sections for possible vulnerabilities introduced by automatically
918-
processing the instance string according to these keywords.
919-
</t>
920899
</section>
921900

922901
<section title="contentEncoding">
923902

924903
<t>
925904
If the instance value is a string, this property defines that the string
926-
SHOULD be interpreted as encoded binary data and decoded using the encoding
927-
named by this property.
905+
SHOULD be interpreted as encoded binary data and applications wishing
906+
to decode it SHOULD do so using the encoding named by this property.
928907
</t>
929908

930909
<t>
@@ -976,7 +955,8 @@
976955
</t>
977956
<t>
978957
This keyword MAY be used with any media type that can be mapped into
979-
JSON Schema's data model.
958+
JSON Schema's data model. Specifying such mappings is outside of the
959+
scope of this specification.
980960
</t>
981961
<t>
982962
The value of this property MUST be a valid JSON schema. It SHOULD be ignored if

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /