json_schemer icon indicating copy to clipboard operation
json_schemer copied to clipboard

Optionally forbid unsupported keywords in metaschema validation?

Open eapache-opslevel opened this issue 11 months ago • 2 comments

Per https://github.com/json-schema-org/json-schema-spec/issues/577, JSON Schema metaschemas generally allow unsupported keywords to be present.

We recently hit a similar issue as the person who filed that ticket, where a typo in our schema silently removed some validations we thought were running.

As an implementation, it would be very handy if json_schemer allowed a flag to validate_schema that "turned on" additionalProperties: false for the metaschema in order to catch such things.

eapache-opslevel avatar Jan 10 '25 18:01 eapache-opslevel

This is an interesting idea. It sounds similar to json-schema's strict option:

#
# with the `:strict` option, all properties are considered to have `"required": true` and all objects `"additionalProperties": false`
#

# => true
JSON::Validator.validate(schema, { "a" => 1, "b" => { "x" => 2 } }, :strict => true)
# => false
JSON::Validator.validate(schema, { "a" => 1, "b" => { "x" => 2 }, "c" => 3 }, :strict => true)
# => false
JSON::Validator.validate(schema, { "a" => 1 }, :strict => true)

I think it makes sense to offer it as an option for both metaschema and regular validation. I probably won't work on this in the near future myself, but if you're interested in contributing, I'd be happy to help/review.

For just meta schema validation like you're talking about, you might be able to create a custom meta schema that includes additionalProperties: false everywhere.

davishmcclurg avatar Jan 19 '25 23:01 davishmcclurg

you might be able to create a custom meta schema that includes additionalProperties: false everywhere

Yeah, I took a quick peek at this. It's definitely possible, but unfortunately not as trivial as one might hope.

Also found that the next version of the json-schema spec will probably do this by default: https://json-schema.org/blog/posts/the-last-breaking-change

eapache-opslevel avatar Jan 20 '25 15:01 eapache-opslevel