Skip to content

Commit e59dc7a

Browse files
committed
Disallow even optional "content*" processing
This added substantial complexity for essentially no benefit. The functionality could be trivially implemented as a library on top of a JSON Schema implementation that supports annotation collection.
1 parent d59bda8 commit e59dc7a

File tree

1 file changed

+7
-26
lines changed

1 file changed

+7
-26
lines changed

jsonschema-validation.xml

Lines changed: 7 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -936,42 +936,22 @@
936936
<t>
937937
Due to security and performance concerns, as well as the open-ended nature of
938938
possible content types, implementations MUST NOT automatically decode, parse,
939-
and/or validate the string contents by default. This additionally supports
940-
the use case of embedded documents intended for processing by a different
941-
consumer than that which processed the containing document.
939+
and/or validate the string contents. Applications are expected to use these
940+
annotations to invoke the appropriate libraries (including JSON Schema for
941+
any further schema-based validation) separately.
942942
</t>
943943
<t>
944944
All keywords in this section apply only to strings, and have no
945945
effect on other data types.
946946
</t>
947-
<t>
948-
Implementations MAY offer the ability to decode, parse, and/or validate
949-
the string contents automatically. However, it MUST NOT perform these
950-
operations by default, and MUST provide the validation result of each
951-
string-encoded document separately from the enclosing document. This
952-
process SHOULD be equivalent to fully evaluating the instance against
953-
the original schema, followed by using the annotations to decode, parse,
954-
and/or validate each string-encoded document.
955-
<cref>
956-
For now, the exact mechanism of performing and returning parsed
957-
data and/or validation results from such an automatic decoding, parsing,
958-
and validating feature is left unspecified. Should such a feature
959-
prove popular, it may be specified more thoroughly in a future draft.
960-
</cref>
961-
</t>
962-
<t>
963-
See also the <xref target="security">Security Considerations</xref>
964-
sections for possible vulnerabilities introduced by automatically
965-
processing the instance string according to these keywords.
966-
</t>
967947
</section>
968948

969949
<section title="contentEncoding">
970950

971951
<t>
972952
If the instance value is a string, this property defines that the string
973-
SHOULD be interpreted as encoded binary data and decoded using the encoding
974-
named by this property.
953+
SHOULD be interpreted as encoded binary data and, and applications wishing
954+
to decode it SHOULD do so using the encoding named by this property.
975955
</t>
976956

977957
<t>
@@ -1023,7 +1003,8 @@
10231003
</t>
10241004
<t>
10251005
This keyword MAY be used with any media type that can be mapped into
1026-
JSON Schema's data model.
1006+
JSON Schema's data model. Specifying such mappings is outside of the
1007+
scope of this specification.
10271008
</t>
10281009
<t>
10291010
The value of this property MUST be a valid JSON schema. It SHOULD be ignored if

0 commit comments

Comments
 (0)