schemagen builder accepts duplicate unknown keys in non-strict objects #20

Closed
opened 2026-06-21 13:22:33 +00:00 by weaselbot · 1 comment
Member

The generated builder only tracks populated fields (seen) for keys that match the schema. Unknown keys are marked as kSkip and never update the bitset. As a result, when additionalProperties is not false, the same unknown key can appear multiple times without triggering the duplicate-key rejection that the README documents.

Relevant generator code in contrib/schemagen/weaseljson_schemagen.py:

  • Lines 955-972 (cbKeyData template): duplicate-key check at lines 968-970 only runs for matched (idx >= 0) keys; unknown keys go to the skip branch at lines 963-966 without recording anything.
  • Lines 906-916 (valueComplete): the seen bitset is only updated for matched fields (p.field >= 0).

Schema:

{
  "type": "object",
  "properties": { "known": { "type": "string" } }
}

Input: {"unknown":1,"unknown":2}

  • Actual: WeaselJson_OK (the object is accepted).
  • Expected: WeaselJson_REJECT (duplicate object key).

The README lists "duplicate object keys" as a schema violation, and the existing test_gen.cpp checks duplicate matched keys. Duplicate unknown keys currently bypass that check.

Impact: the generated parser does not enforce the documented duplicate-key policy for permissive objects, which can mislead callers that rely on the builder for JSON validation.

The generated builder only tracks populated fields (`seen`) for keys that match the schema. Unknown keys are marked as `kSkip` and never update the bitset. As a result, when `additionalProperties` is not `false`, the same unknown key can appear multiple times without triggering the duplicate-key rejection that the README documents. Relevant generator code in `contrib/schemagen/weaseljson_schemagen.py`: - Lines 955-972 (`cbKeyData` template): duplicate-key check at lines 968-970 only runs for matched (`idx >= 0`) keys; unknown keys go to the skip branch at lines 963-966 without recording anything. - Lines 906-916 (`valueComplete`): the `seen` bitset is only updated for matched fields (`p.field >= 0`). Schema: ```json { "type": "object", "properties": { "known": { "type": "string" } } } ``` Input: `{"unknown":1,"unknown":2}` - Actual: `WeaselJson_OK` (the object is accepted). - Expected: `WeaselJson_REJECT` (duplicate object key). The README lists "duplicate object keys" as a schema violation, and the existing `test_gen.cpp` checks duplicate matched keys. Duplicate unknown keys currently bypass that check. Impact: the generated parser does not enforce the documented duplicate-key policy for permissive objects, which can mislead callers that rely on the builder for JSON validation.
Owner

We should drop support for additionalProperties = true

We should drop support for `additionalProperties = true`
weaselbot was assigned by andrew 2026-06-23 15:08:13 +00:00
Sign in to join this conversation.
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: weaselab/weaseljson#20