Schema3 and parsing fixes - #210
Open
michalz-zoom wants to merge 6 commits into
Open
Conversation
Buffer.from(s, 'hex') silently drops invalid suffix bytes, so is_hex, unhex, and schema binary convert accepted malformed hex.
check() returns an error or null, so the loop was treating failures as matches and accepting no valid term.
_check_value built a null error and dropped it, so required fields accepted null and undefined.
Object.prototype names were treated as present schema keys, and __proto__ can set [[Prototype]] instead of a data field.
lookup_tab[type] and extra_lookup_tab[type] followed the prototype chain, so names like toString resolved to functions instead of missing classes.
michalz-zoom
force-pushed
the
michal/fixes
branch
from
September 3, 2026 16:36
4937f14 to
087e0d5
Compare
michalz-zoom
force-pushed
the
michal/fixes
branch
from
September 3, 2026 18:59
087e0d5 to
3430dd4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
decode_hexrejects invalid/trailing junk instead ofBuffer.from(..., 'hex')silently truncating; used byis_hex,unhex, and schema binary convert.check()returns an error or null, so the loop was inverted; matching terms are accepted and the WoT bad-proof case is covered._check_valuenow returns the null error instead of dropping it, so required fields reject null/undefined.__proto__keys and use own-property lookups in schema3: lookups usehasOwnProperty.call;__proto__is banned as a schema, payload, and enum key.allocuses own-property lookup, so prototype names are unknown types instead of inherited functions.users_lookupmaps responses with Map instead of a plain object, so identifiers cannot collide with prototype keys.