Correct handling of / in pattern

[tschmidtb51]

I'm wondering whether the following pattern ^ANY:/[ab]$ is a valid JSON pattern. Many implementations accept it but for example Deno requires to escape the / for it to be valid. So the question is: Is that an issue with the pattern or with deno? How should the spec be interpreted? (I had a look through the spec but was not really successful to resolve the question).

[gregsdennis]

By "Deno" I imagine you mean https://deno.com/? This seems more like a question about how Javascript handles regex rather than a JSON Schema question.

Can you elaborate?

[tschmidtb51]

This seems more like a question about how Javascript handles regex rather than a JSON Schema question.

Can you elaborate?

Sure. IMHO, this is a JSON question:
I created a GitHub repo to back the question with code...

I my reading of the JSON spec, / is not a special character in a pattern and therefore should not be needed to be escaped. For example, the reference implementation of the CSAF validation library uses the JSON schema provided by the CSAF standard. There, the / was not escaped and it worked with python and node. However, when a colleague used deno, he complained about the "missing" escaping (and another bug; see secvisogram/csaf-validator-lib#156 for the full story).

So my question is: Do I need to escape / in JSON patterns or is that a bug in the deno implementation when they convert the JSON pattern into their regex?

Does that make sense?

[tschmidtb51]

For clarification:
CSAF: Common Security Advisory Framework - an international, open standard for machine-readable security information (including, but not limited to security advisories, VEX and informational advisories).

[gregsdennis]

We don't control anything about JSON here. We're only JSON Schema, which operates on the JSON data model not on the encoding itself.

That said, it sounds like a bug in Deno to me. / isn't required to be escaped by JSON. It exists in pointers all of the time. I'm not sure about whether a Javascript regex would require it to be escaped, though.

[jdesrosiers]

JSON doesn't have regular expressions, so it has nothing to say about the matter.

JSON Schema has regular expressions expressed as strings. JSON Schema implementations are expected to use whatever regex engine is available in the language the implementation is written in. Since you mention deno, that means this is a JavaScript question. Specifically, the question is, does new Regex() in JavaScript require / to be escaped? I tried it in node.js, deno, and firefox and in all cases, the answer is "no", it does not need to be escaped.

[tschmidtb51]

Thank you for your answer. We will consider your answer. For the future, it would be nice, if that could be clarified in the standard and would not depend upon the implementation. That would make it easier to write a schema that is interoperable with "all" implementations.