docs/options.md

@@ -69,6 +69,7 @@ const defaultOptions = {
     source: false,
     process: undefined, // (code: string) => string
     optimize: true,
+    regExp: RegExp
   },
 }
 ```
@@ -361,6 +362,12 @@ type CodeOptions = {
   // Code snippet created with `_` tagged template literal that contains all format definitions,
   // it can be the code of actual definitions or `require` call:
   // _`require("./my-formats")`
+  regExp: RegExpEngine
+  // Pass non-standard RegExp engine to mitigate ReDoS, e.g. node-re2.
+  // During validation of a schema, code.regExp will be 
+  // used to match strings against regular expressions.
+  // The supplied function must support the interface:
+  // regExp(regex, unicodeFlag).test(string) => boolean
 }
 
 type Source = {

lib/core.ts

@@ -48,6 +48,7 @@ import type {
   ErrorObject,
   Format,
   AddedFormat,
+  RegExpEngine,
 } from "./types"
 import type {JSONSchemaType} from "./types/json-schema"
 import type {JTDSchemaType, SomeJTDSchemaType, JTDDataType} from "./types/jtd-schema"
@@ -62,6 +63,9 @@ import {eachItem} from "./compile/util"
 
 import * as $dataRefSchema from "./refs/data.json"
 
+const defaultRegExp: RegExpEngine = (str, flags) => new RegExp(str, flags)
+defaultRegExp.code = "new RegExp"
+
 const META_IGNORE_OPTIONS: (keyof Options)[] = ["removeAdditional", "useDefaults", "coerceTypes"]
 const EXT_SCOPE_NAMES = new Set([
   "validate",
@@ -141,9 +145,11 @@ export interface CodeOptions {
   formats?: Code // code to require (or construct) map of available formats - for standalone code
   source?: boolean
   process?: (code: string, schema?: SchemaEnv) => string
+  regExp?: RegExpEngine
 }
 
 interface InstanceCodeOptions extends CodeOptions {
+  regExp: RegExpEngine
   optimize: number
 }
 
@@ -231,13 +237,14 @@ function requiredOptions(o: Options): RequiredInstanceOptions {
   const s = o.strict
   const _optz = o.code?.optimize
   const optimize = _optz === true || _optz === undefined ? 1 : _optz || 0
+  const regExp = o.code?.regExp ?? defaultRegExp
   return {
     strictSchema: o.strictSchema ?? s ?? true,
     strictNumbers: o.strictNumbers ?? s ?? true,
     strictTypes: o.strictTypes ?? s ?? "log",
     strictTuples: o.strictTuples ?? s ?? "log",
     strictRequired: o.strictRequired ?? s ?? false,
-    code: o.code ? {...o.code, optimize} : {optimize},
+    code: o.code ? {...o.code, optimize, regExp} : {optimize, regExp},
     loopRequired: o.loopRequired ?? MAX_EXPRESSION,
     loopEnum: o.loopEnum ?? MAX_EXPRESSION,
     meta: o.meta ?? true,
@@ -279,6 +286,7 @@ export default class Ajv {
   constructor(opts: Options = {}) {
     opts = this.opts = {...opts, ...requiredOptions(opts)}
     const {es5, lines} = this.opts.code
+
     this.scope = new ValueScope({scope: {}, prefixes: EXT_SCOPE_NAMES, es5, lines})
     this.logger = getLogger(opts.logger)
     const formatOpt = opts.validateFormats

lib/runtime/re2.ts

@@ -0,0 +1,6 @@
+import * as re2 from "re2"
+
+type Re2 = typeof re2 & {code: string}
+;(re2 as Re2).code = 'require("ajv/dist/runtime/re2").default'
+
+export default re2 as Re2

lib/types/index.ts

@@ -222,3 +222,12 @@ export type AddedFormat =
   | AsyncFormatDefinition<number>
 
 export type Format = AddedFormat | string
+
+export interface RegExpEngine {
+  (pattern: string, u: string): RegExpLike
+  code: string
+}
+
+export interface RegExpLike {
+  test: (s: string) => boolean
+}

lib/vocabularies/code.ts

@@ -4,7 +4,7 @@ import type {KeywordCxt} from "../compile/validate"
 import {CodeGen, _, and, or, not, nil, strConcat, getProperty, Code, Name} from "../compile/codegen"
 import {alwaysValidSchema, Type} from "../compile/util"
 import N from "../compile/names"
-
+import {useFunc} from "../compile/util"
 export function checkReportMissingProp(cxt: KeywordCxt, prop: string): void {
   const {gen, data, it} = cxt
   gen.if(noPropertyInData(gen, data, prop, it.opts.ownProperties), () => {
@@ -90,12 +90,16 @@ export function callValidateCode(
   return context !== nil ? _`${func}.call(${context}, ${args})` : _`${func}(${args})`
 }
 
+const newRegExp = _`new RegExp`
+
 export function usePattern({gen, it: {opts}}: KeywordCxt, pattern: string): Name {
   const u = opts.unicodeRegExp ? "u" : ""
+  const {regExp} = opts.code
+
   return gen.scopeValue("pattern", {
     key: pattern,
-    ref: new RegExp(pattern, u),
-    code: _`new RegExp(${pattern}, ${u})`,
+    ref: regExp(pattern, u),
+    code: _`${regExp.code === "new RegExp" ? newRegExp : useFunc(gen, regExp)}(${pattern}, ${u})`,
   })
 }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ajv",
-  "version": "8.7.1",
+  "version": "8.8.0",
   "description": "Another JSON Schema Validator",
   "main": "dist/ajv.js",
   "types": "dist/ajv.d.ts",
@@ -17,7 +17,8 @@
     "test-codegen": "nyc cross-env TS_NODE_PROJECT=spec/tsconfig.json mocha -r ts-node/register 'spec/codegen.spec.ts' -R spec",
     "test-debug": "npm run test-spec -- --inspect-brk",
     "test-cov": "nyc npm run test-spec",
-    "bundle": "rm -rf bundle && rollup -c",
+    "rollup": "rm -rf bundle && rollup -c",
+    "bundle": "rm -rf bundle && node ./scripts/bundle.js ajv ajv7 ajv7 && node ./scripts/bundle.js 2019 ajv2019 ajv2019 && node ./scripts/bundle.js 2020 ajv2020 ajv2020 && node ./scripts/bundle.js jtd ajvJTD ajvJTD",
     "build": "rm -rf dist && tsc && cp -r lib/refs dist && rm dist/refs/json-schema-2019-09/index.ts && rm dist/refs/json-schema-2020-12/index.ts && rm dist/refs/jtd-schema.ts",
     "json-tests": "rm -rf spec/_json/*.js && node scripts/jsontests",
     "test-karma": "karma start",
@@ -75,6 +76,7 @@
     "@typescript-eslint/eslint-plugin": "^3.8.0",
     "@typescript-eslint/parser": "^3.8.0",
     "ajv-formats": "^3.0.0-rc.0",
+    "browserify": "^17.0.0",
     "chai": "^4.0.1",
     "cross-env": "^7.0.2",
     "dayjs": "^1.10.4",
@@ -95,6 +97,7 @@
     "node-fetch": "^3.0.0",
     "nyc": "^15.0.0",
     "prettier": "^2.3.1",
+    "re2": "^1.16.0",
     "rollup": "^2.44.0",
     "rollup-plugin-terser": "^7.0.2",
     "ts-node": "^10.0.0",

rollup.config.js

@@ -26,7 +26,7 @@ function createBundleConfig(sourceFile, outFile, globalName) {
 }
 
 export default [
-  createBundleConfig("ajv", "ajv7", "av7"),
+  createBundleConfig("ajv", "ajv7", "ajv7"),
   createBundleConfig("2019", "ajv2019", "ajv2019"),
   createBundleConfig("2020", "ajv2020", "ajv2020"),
   createBundleConfig("jtd", "ajvJTD", "ajvJTD"),

scripts/bundle.js

@@ -0,0 +1,48 @@
+"use strict"
+
+const fs = require("fs")
+const path = require("path")
+const browserify = require("browserify")
+const {minify} = require("terser")
+
+const [sourceFile, outFile, globalName] = process.argv.slice(2)
+
+const json = require(path.join(__dirname, "..", "package.json"))
+const bundleDir = path.join(__dirname, "..", "bundle")
+if (!fs.existsSync(bundleDir)) fs.mkdirSync(bundleDir)
+
+browserify({standalone: globalName})
+  .require(path.join(__dirname, "../dist", sourceFile), {expose: sourceFile})
+  .bundle(saveAndMinify)
+
+async function saveAndMinify(err, buf) {
+  if (err) {
+    console.error("browserify error:", err)
+    process.exit(1)
+  }
+
+  const bundlePath = path.join(bundleDir, outFile)
+  const opts = {
+    ecma: 2018,
+    warnings: true,
+    compress: {
+      pure_getters: true,
+      keep_infinity: true,
+      unsafe_methods: true,
+    },
+    format: {
+      preamble: `/* ${json.name} ${json.version} (${globalName}): ${json.description} */`,
+    },
+    sourceMap: {
+      filename: outFile + ".min.js",
+      url: outFile + ".min.js.map",
+    },
+  }
+
+  const result = await minify(buf.toString(), opts)
+
+  fs.writeFileSync(bundlePath + ".bundle.js", buf)
+  fs.writeFileSync(bundlePath + ".min.js", result.code)
+  fs.writeFileSync(bundlePath + ".min.js.map", result.map)
+  if (result.warnings) result.warnings.forEach((msg) => console.warn("terser.minify warning:", msg))
+}

spec/issues/1683_re2_engine.spec.ts

@@ -0,0 +1,33 @@
+import getAjvAllInstances from "../ajv_all_instances"
+import {withStandalone} from "../ajv_standalone"
+import {_} from "../../dist/compile/codegen/code"
+import jsonSchemaTest = require("json-schema-test")
+import options from "../ajv_options"
+import {afterError, afterEach} from "../after_test"
+import chai from "../chai"
+import re2 from "../../dist/runtime/re2"
+import re2tests from "./re2"
+
+const instances = getAjvAllInstances(options, {
+  $data: true,
+  formats: {allowedUnknown: true},
+  strictTypes: false,
+  strictTuples: false,
+})
+
+instances.forEach((ajv) => {
+  ajv.opts.code.source = true
+  ajv.opts.code.formats = _`{allowedUnknown: true}`
+  ajv.opts.code.regExp = re2
+})
+
+jsonSchemaTest(withStandalone(instances), {
+  description: "Test with re2 RegExp engine with " + instances.length + " ajv instances",
+  suites: {"regular expressions": re2tests},
+  assert: chai.assert,
+  afterError,
+  afterEach,
+  cwd: __dirname,
+  hideFolder: "extras/",
+  timeout: 90000,
+})

spec/issues/re2.ts

@@ -0,0 +1,4 @@
+export default [
+  {name: "$data/format", test: require("../extras/$data/format.json")},
+  {name: "$data/pattern", test: require("../extras/$data/pattern.json")},
+]