unsafe slash-separated scope (schema-path)

[mirismaili]

Describe the bug

Very similar to #1849 but for scopes (or schemaPaths).

jsonforms/packages/core/src/generators/uischema.ts

Lines 115 to 202 in 075bbc4

	const generateUISchema = (
	jsonSchema: JsonSchema,
	schemaElements: UISchemaElement[],
	currentRef: string,
	schemaName: string,
	layoutType: string,
	rootSchema?: JsonSchema
	): UISchemaElement => {
	if (!isEmpty(jsonSchema) && jsonSchema.$ref !== undefined) {
	return generateUISchema(
	resolveSchema(rootSchema, jsonSchema.$ref),
	schemaElements,
	currentRef,
	schemaName,
	layoutType,
	rootSchema
	);
	}
	if (isCombinator(jsonSchema)) {
	const controlObject: ControlElement = createControlElement(currentRef);
	schemaElements.push(controlObject);
	return controlObject;
	}
	const types = deriveTypes(jsonSchema);
	if (types.length === 0) {
	return null;
	}
	if (types.length > 1) {
	const controlObject: ControlElement = createControlElement(currentRef);
	schemaElements.push(controlObject);
	return controlObject;
	}
	if (currentRef === '#' && types[0] === 'object') {
	const layout: Layout = createLayout(layoutType);
	schemaElements.push(layout);
	if (jsonSchema.properties && keys(jsonSchema.properties).length > 1) {
	addLabel(layout, schemaName);
	}
	if (!isEmpty(jsonSchema.properties)) {
	// traverse properties
	const nextRef: string = currentRef + '/properties';
	Object.keys(jsonSchema.properties).map(propName => {
	let value = jsonSchema.properties[propName];
	const ref = `${nextRef}/${propName}`;
	if (value.$ref !== undefined) {
	value = resolveSchema(rootSchema, value.$ref);
	}
	generateUISchema(
	value,
	layout.elements,
	ref,
	propName,
	layoutType,
	rootSchema
	);
	});
	}
	return layout;
	}
	switch (types[0]) {
	case 'object': // object items will be handled by the object control itself
	/* falls through */
	case 'array': // array items will be handled by the array control itself
	/* falls through */
	case 'string':
	/* falls through */
	case 'number':
	/* falls through */
	case 'integer':
	/* falls through */
	case 'boolean':
	const controlObject: ControlElement = createControlElement(currentRef);
	schemaElements.push(controlObject);
	return controlObject;
	default:
	throw new Error('Unknown type: ' + JSON.stringify(jsonSchema));
	}
	};

As you can see in the above snippet, ref will be currentRef of the generated ui-schema:

jsonforms/packages/core/src/generators/uischema.ts

Lines 169 to 176 in 075bbc4

	generateUISchema(
	value,
	layout.elements,
	ref,
	propName,
	layoutType,
	rootSchema
	);

and it will be used as the scope of control elements:

jsonforms/packages/core/src/generators/uischema.ts

Line 195 in 075bbc4

const controlObject: ControlElement = createControlElement(currentRef);

But it's created by two string-concatenations (line 162 & line 165):

jsonforms/packages/core/src/generators/uischema.ts

Lines 162 to 165 in 075bbc4

	const nextRef: string = currentRef + '/properties';
	Object.keys(jsonSchema.properties).map(propName => {
	let value = jsonSchema.properties[propName];
	const ref = `${nextRef}/${propName}`;

const nextRef: string = currentRef + '/properties';
...
const ref = `${nextRef}/${propName}`;

The second one is obviously unsafe. Because we don't know anything about propName. It may be foo/bar/baz. Then we have issues in toDataPathSegments():

jsonforms/packages/core/src/util/path.ts

Lines 58 to 68 in 075bbc4

	export const toDataPathSegments = (schemaPath: string): string[] => {
	const s = schemaPath
	.replace(/anyOf\/[\d]\//g, '')
	.replace(/allOf\/[\d]\//g, '')
	.replace(/oneOf\/[\d]\//g, '');
	const segments = s.split('/');
	const startFromRoot = segments[0] === '#' || segments[0] === '';
	const startIndex = startFromRoot ? 2 : 1;
	return range(startIndex, segments.length, 2).map(idx => segments[idx]);
	};

Because toDataPathSegments('#/properties/foo/bar/baz') will be ['foo', 'baz']!

Expected behavior

/ character should safely be escaped or a string[] should be used for scopes:

For example:

// using string[]:
scope = ['#', 'properties', 'foo/bar/baz']

// AJV-like `instancePath` encoding:
scope = '#/properties/foo~1bar~1baz'

Then toDataPathSegments() can parse its input correctly and will return ['foo/bar/baz'].

Steps to reproduce the issue

1. Go to Playground
2. Set:
   JSON-Schema:

   {
     "type": "object",
     "properties": {
       "foo/bar": {
         "type": "string"
       }
     }
   }

   UI-Schema:

   false

   Data:

   {}

Screenshots

In which browser are you experiencing the issue?

Google Chrome v96.0.4664.93 (Official Build) (64-bit)

Framework

No response

RendererSet

No response

Additional context

No response

[sdirix]

Hi @mirismaili thanks for the report. We are already working on this by encoding slashed whenever necessary, see #1834

[sdirix]

This should be fixed now with #1834. Please reopen if you still encounter problems.