Description
Hi,
The uri, uriref and uri-reference type of fields are incorrectly being validated with filter_var($element, FILTER_VALIDATE_URL); as this php function validates only URLs and it does not (cannot) validate URIs.
So while the https://example.com is a valid URL the urn:oasis:names:specification:docbook:dtd:xml:4.1.2 is not, however it is a valid URI. Therefore these kind of fields should be validated differently, php does not have built-in functionality to do this.
In the related php ticket it is being mentioned that URIs could be validated simply as <scheme>:<extra> or implement RFC 3986.
Example JSON document that can cause a validation error.
{
"openapi": "3.0.2",
"info": {
"title": "Example",
"version": "1.0.0"
},
"paths": {
"/example": {
"post": {
"requestBody": {
"content": {
"application/xml": {
"schema": {
"$ref": "#/components/schemas/exampleXml"
}
}
}
},
"responses": {
"200": {
"description": "Success"
}
}
}
}
},
"components": {
"schemas": {
"exampleXml": {
"type": "string",
"xml": {
"name": "Document",
"namespace": "urn:isbn:0451450523"
}
}
}
}
}Example script to reproduce the issue.
<?php declare(strict_types = 1);
require_once('vendor/autoload.php');
use JsonSchema\Validator;
$data = json_decode(file_get_contents('test.json'));
$schema = json_decode(file_get_contents('https://raw.githubusercontent.com/OAI/OpenAPI-Specification/main/schemas/v3.0/schema.json'));
// Validate.
$validator = new Validator();
$validator->validate($data, $schema);
if ($validator->isValid()) {
echo "The supplied JSON validates against the schema.\n";
}
else {
echo "JSON does not validate. Violations:\n";
foreach ($validator->getErrors() as $error) {
printf("[%s] %s\n", $error['property'], $error['message']);
}
}The validation error is: [components.schemas.exampleXml.xml.namespace] Invalid URL format.
(Unrelated but there is also a [components.schemas.exampleXml.$ref] The property $ref is required validation error, however it is not being marked as an issue for example by https://editor.swagger.io/)
Related: