Skip to content

Schema3 and parsing fixes - #210

Open
michalz-zoom wants to merge 4 commits into
masterfrom
michal/fixes
Open

Schema3 and parsing fixes#210
michalz-zoom wants to merge 4 commits into
masterfrom
michal/fixes

Conversation

@michalz-zoom

@michalz-zoom michalz-zoom commented Sep 1, 2026

Copy link
Copy Markdown
Contributor
  • Fix hex decoding of trailing junk: decode_hex rejects invalid/trailing junk instead of Buffer.from(..., 'hex') silently truncating; used by is_hex, unhex, and schema binary convert.
  • Fix Or combinator in schema3: check() returns an error or null, so the loop was inverted; matching terms are accepted and the WoT bad-proof case is covered.
  • Return errors for null schema values: _check_value now returns the null error instead of dropping it, so required fields reject null/undefined.
  • Reject __proto__ keys and use own-property lookups in schema3: lookups use hasOwnProperty.call; __proto__ is banned as a schema, payload, and enum key.

Buffer.from(s, 'hex') silently drops invalid suffix bytes, so is_hex,
unhex, and schema binary convert accepted malformed hex.
check() returns an error or null, so the loop was treating failures as
matches and accepting no valid term.
_check_value built a null error and dropped it, so required fields
accepted null and undefined.
Object.prototype names were treated as present schema keys, and
__proto__ can set [[Prototype]] instead of a data field.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant