ajv - npm Package Compare versions

Comparing version 8.17.1 to 8.18.0

dist/compile/jtd/serialize.js

@@ -198,4 +198,11 @@ "use strict";
 }
-function serializeNumber({ gen, data }) {
-    gen.add(names_1.default.json, (0, codegen_1._) `"" + ${data}`);
+function serializeNumber({ gen, data, self }) {
+    const condition = (0, codegen_1._) `${data} === Infinity || ${data} === -Infinity || ${data} !== ${data}`;
+    if (self.opts.specialNumbers === undefined || self.opts.specialNumbers === "fast") {
+        gen.add(names_1.default.json, (0, codegen_1._) `"" + ${data}`);
+    }
+    else {
+        // specialNumbers === "null"
+        gen.if(condition, () => gen.add(names_1.default.json, (0, codegen_1._) `null`), () => gen.add(names_1.default.json, (0, codegen_1._) `"" + ${data}`));
+    }
 }
@@ -202,0 +209,0 @@ function serializeRef(cxt) {

dist/core.d.ts

@@ -40,2 +40,3 @@ export { Format, FormatDefinition, AsyncFormatDefinition, KeywordDefinition, KeywordErrorDefinition, CodeKeywordDefinition, MacroKeywordDefinition, FuncKeywordDefinition, Vocabulary, Schema, SchemaObject, AnySchemaObject, AsyncSchema, AnySchema, ValidateFunction, AsyncValidateFunction, AnyValidateFunction, ErrorObject, ErrorNoParams, } from "./types";
     allowDate?: boolean;
+    specialNumbers?: "fast" | "null";
     $comment?: true | ((comment: string, schemaPath?: string, rootSchema?: AnySchemaObject) => unknown);
@@ -42,0 +43,0 @@ formats?: {

dist/vocabularies/validation/pattern.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const code_1 = require("../code");
+const util_1 = require("../../compile/util");
 const codegen_1 = require("../../compile/codegen");
@@ -16,7 +17,15 @@ const error = {
     code(cxt) {
-        const { data, $data, schema, schemaCode, it } = cxt;
-        // TODO regexp should be wrapped in try/catchs
+        const { gen, data, $data, schema, schemaCode, it } = cxt;
         const u = it.opts.unicodeRegExp ? "u" : "";
-        const regExp = $data ? (0, codegen_1._) `(new RegExp(${schemaCode}, ${u}))` : (0, code_1.usePattern)(cxt, schema);
-        cxt.fail$data((0, codegen_1._) `!${regExp}.test(${data})`);
+        if ($data) {
+            const { regExp } = it.opts.code;
+            const regExpCode = regExp.code === "new RegExp" ? (0, codegen_1._) `new RegExp` : (0, util_1.useFunc)(gen, regExp);
+            const valid = gen.let("valid");
+            gen.try(() => gen.assign(valid, (0, codegen_1._) `${regExpCode}(${schemaCode}, ${u}).test(${data})`), () => gen.assign(valid, false));
+            cxt.fail$data((0, codegen_1._) `!${valid}`);
+        }
+        else {
+            const regExp = (0, code_1.usePattern)(cxt, schema);
+            cxt.fail$data((0, codegen_1._) `!${regExp}.test(${data})`);
+        }
     },
@@ -23,0 +32,0 @@ };

lib/compile/jtd/serialize.ts

@@ -231,4 +231,15 @@ import type Ajv from "../../core"
 
-function serializeNumber({gen, data}: SerializeCxt): void {
-  gen.add(N.json, _`"" + ${data}`)
+function serializeNumber({gen, data, self}: SerializeCxt): void {
+  const condition = _`${data} === Infinity || ${data} === -Infinity || ${data} !== ${data}`
+
+  if (self.opts.specialNumbers === undefined || self.opts.specialNumbers === "fast") {
+    gen.add(N.json, _`"" + ${data}`)
+  } else {
+    // specialNumbers === "null"
+    gen.if(
+      condition,
+      () => gen.add(N.json, _`null`),
+      () => gen.add(N.json, _`"" + ${data}`)
+    )
+  }
 }
@@ -235,0 +246,0 @@

lib/core.ts

@@ -110,2 +110,3 @@ export {
   allowDate?: boolean // JTD only
+  specialNumbers?: "fast" | "null" // JTD only
   $comment?:
@@ -112,0 +113,0 @@ | true

lib/vocabularies/validation/pattern.ts

 import type {CodeKeywordDefinition, ErrorObject, KeywordErrorDefinition} from "../../types"
 import type {KeywordCxt} from "../../compile/validate"
 import {usePattern} from "../code"
+import {useFunc} from "../../compile/util"
 import {_, str} from "../../compile/codegen"
@@ -20,7 +21,17 @@
   code(cxt: KeywordCxt) {
-    const {data, $data, schema, schemaCode, it} = cxt
-    // TODO regexp should be wrapped in try/catchs
+    const {gen, data, $data, schema, schemaCode, it} = cxt
     const u = it.opts.unicodeRegExp ? "u" : ""
-    const regExp = $data ? _`(new RegExp(${schemaCode}, ${u}))` : usePattern(cxt, schema)
-    cxt.fail$data(_`!${regExp}.test(${data})`)
+    if ($data) {
+      const {regExp} = it.opts.code
+      const regExpCode = regExp.code === "new RegExp" ? _`new RegExp` : useFunc(gen, regExp)
+      const valid = gen.let("valid")
+      gen.try(
+        () => gen.assign(valid, _`${regExpCode}(${schemaCode}, ${u}).test(${data})`),
+        () => gen.assign(valid, false)
+      )
+      cxt.fail$data(_`!${valid}`)
+    } else {
+      const regExp = usePattern(cxt, schema)
+      cxt.fail$data(_`!${regExp}.test(${data})`)
+    }
   },
@@ -27,0 +38,0 @@ }

package.json

 {
   "name": "ajv",
-  "version": "8.17.1",
+  "version": "8.18.0",
   "description": "Another JSON Schema Validator",
@@ -12,2 +12,3 @@ "main": "dist/ajv.js",
   ],
+  "sideEffects": false,
   "scripts": {
@@ -14,0 +15,0 @@ "eslint": "eslint \"lib/**/*.ts\" \"spec/**/*.*s\" --ignore-pattern spec/JSON-Schema-Test-Suite",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1033513

0.25%

Lines of code

20053

0.19%

Worsened metrics

Number of low supply chain risk alerts

10

42.86%

No dependency changes