infinite loop with Constraint::CHECK_MODE_APPLY_DEFAULTS

[mathroc]

I've found an issue, with some schema, the validator will go into an infinite loop and eventually terminate when the allowed memory is exhausted, you can reproduce the issue with this code :

<?php

include_once __DIR__."/../vendor/autoload.php";

$validator = new \JsonSchema\Validator();

$data = [];
$schema = (object)['$ref' => 'http://json-schema.org/draft-04/schema'];

echo __LINE__, PHP_EOL;

$validator->validate($data, $schema);

echo __LINE__, PHP_EOL;

$validator->validate($data, $schema, \JsonSchema\Constraints\Constraint::CHECK_MODE_APPLY_DEFAULTS);

echo __LINE__, PHP_EOL;

I'm not sure yet what is causing this. I'll guess a infinite recursion has been introduced in UndefinedConstraint::validateCommonProperties. I'll try to make another reproduction of the bug with a smaller schema

[erayd]

Thanks for finding this! Will see if I can get that fixed this morning; infinite recursion is not good!

[erayd]

Have nailed it down to this so far as a minimal test case:

{
    "properties": {
        "propertyOne": {
            "anyOf": [
                { "$ref": "#" }
            ],
            "default": {}
        }
    }
}

[mathroc]

good job finding the small schema reproducing the issue, my attempts failed because when I replaced (object)['$ref' => 'http://json-schema.org/draft-04/schema'] with its content it was not blocking anymore 😕

and then work got in the way ;)

[erayd]

Yeah, there's some bloody weird behavior happening in there. Still haven't found the root cause, although I'm getting there. Working on several things at once, so it's taking a while.

[erayd]

Have located and fixed an unrelated bug with resolving references - @bighappyface, do you want it (and any other bugs I might find along the way to sorting this one) in the same PR, or do you want a separate PR per bug?

[erayd]

OK, this is really nutty. I'm currently buried in the depths of SchemaStorage, and resolveRef() seems to be taking a file URI, converting it to a schema, then converting it back to a URI again. As far as I can tell, this is not how that method is supposed to behave!

[erayd]

@mathroc @shmax @bighappyface Is there any scenario where a $ref to # is ever valid, and does not result in an infinite recursion if fully dereferenced?

[shmax]

Sorry, not an expert on that stuff. If you can provide a minimal code snippet I can help debug.

[erayd]

The minimal schema example I posted above is all I've got at the moment unfortunately. If you can be a bit more specific I can try to isolate bits that might help.

My hope is that if such a reference is never legal, then I can kill the problem when it sees the reference for the first time. If it's legal, then this will be much more complicated to fix.

[shmax]

Fair enough. If you haven't sorted it out by tomorrow evening I'll fire up the debugger and help research.

[erayd]

Thanks! :-)

[mathroc]

@mathroc @shmax @bighappyface Is there any scenario where a $ref to # is ever valid, and does not result in an infinite recursion if fully dereferenced?

not sure what you mean. a recursive schema is valid (eg: any tree structure). It was added in #277 maybe @jojo1981 or @araines can help finding the issue here ?

[erayd]

I know they're valid - I'm not asking about recursive schemas in general; I'm asking very specifically about whether the single case of a schema that infinitely recurses the root is ever valid (and if it is, is it ever something that anybody could actually use).

That PR looks very useful - thank you for that. I have some more reading to do!

[mathroc]

well I would probably represent a binary tree like this:

{
    "type": "object",
    "properties": {
        "value": {
            "type": "integer"
        },
        "left": {
            "$ref": "#"
        },
        "right": {
            "$ref": "#"
        }
    },
    "required": "value"
}

[erayd]

@mathroc Thank you - exactly what I needed :-).

Complicated fix it is then!