{"action":"created","issue":{"url":"https://api.github.com/repos/justinrainbow/json-schema/issues/396","repository_url":"https://api.github.com/repos/justinrainbow/json-schema","labels_url":"https://api.github.com/repos/justinrainbow/json-schema/issues/396/labels{/name}","comments_url":"https://api.github.com/repos/justinrainbow/json-schema/issues/396/comments","events_url":"https://api.github.com/repos/justinrainbow/json-schema/issues/396/events","html_url":"https://github.com/justinrainbow/json-schema/issues/396","id":215311945,"number":396,"title":"Separated files are not validated correctly","user":{"login":"curry684","id":1455673,"avatar_url":"https://avatars3.githubusercontent.com/u/1455673?v=3","gravatar_id":"","url":"https://api.github.com/users/curry684","html_url":"https://github.com/curry684","followers_url":"https://api.github.com/users/curry684/followers","following_url":"https://api.github.com/users/curry684/following{/other_user}","gists_url":"https://api.github.com/users/curry684/gists{/gist_id}","starred_url":"https://api.github.com/users/curry684/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/curry684/subscriptions","organizations_url":"https://api.github.com/users/curry684/orgs","repos_url":"https://api.github.com/users/curry684/repos","events_url":"https://api.github.com/users/curry684/events{/privacy}","received_events_url":"https://api.github.com/users/curry684/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2017-03-20T01:04:46Z","updated_at":"2017-03-20T23:28:55Z","closed_at":null,"body":"Take a look at the split up OpenAPI/Swagger example definition at https://github.com/OAI/OpenAPI-Specification/blob/master/examples/v2.0/json/petstore-separate/spec/swagger.json.\r\n\r\nIt's split up into multiple files, for example:\r\n```json\r\n            \"schema\": {\r\n              \"$ref\": \"../common/Error.json\"\r\n            }\r\n```\r\nRunning the following command on a local copy of that file ([schema here](https://raw.githubusercontent.com/OAI/OpenAPI-Specification/master/schemas/v2.0/schema.json)):\r\n```sh\r\nvendor/bin/validate-json sample/spec/swagger.json res/schema.json\r\n```\r\nHappily outputs that validation succeeded... even if I add dozens of random characters anywhere in any of the included documents.\r\n\r\nSo it would seem that:\r\n- These references are not resolved at all, and\r\n- The failure to resolve them is completely ignored while it should be blocking successful validation\r\n"},"comment":{"url":"https://api.github.com/repos/justinrainbow/json-schema/issues/comments/287930188","html_url":"https://github.com/justinrainbow/json-schema/issues/396#issuecomment-287930188","issue_url":"https://api.github.com/repos/justinrainbow/json-schema/issues/396","id":287930188,"user":{"login":"erayd","id":121486,"avatar_url":"https://avatars0.githubusercontent.com/u/121486?v=3","gravatar_id":"","url":"https://api.github.com/users/erayd","html_url":"https://github.com/erayd","followers_url":"https://api.github.com/users/erayd/followers","following_url":"https://api.github.com/users/erayd/following{/other_user}","gists_url":"https://api.github.com/users/erayd/gists{/gist_id}","starred_url":"https://api.github.com/users/erayd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erayd/subscriptions","organizations_url":"https://api.github.com/users/erayd/orgs","repos_url":"https://api.github.com/users/erayd/repos","events_url":"https://api.github.com/users/erayd/events{/privacy}","received_events_url":"https://api.github.com/users/erayd/received_events","type":"User","site_admin":false},"created_at":"2017-03-20T23:28:55Z","updated_at":"2017-03-20T23:28:55Z","body":"> Actually that's more or less what I was writing right now :)\r\n\r\nThat looks pretty good :-). :+1: \r\n\r\nNote that with `ObjectIterator`, `$key` is fairly meaningless - it's just an internal reference to how `ObjectIterator` has flattened its input object.\r\n\r\nI'd also recommend catching a few more error cases if this will be handling untrusted data:\r\n * `file_get_contents` failure or malicious input URI\r\n * `json_decode` failure\r\n * `$target->$part` being undefined\r\n\r\nIf you aren't feeding it untrusted data, then obviously you may not care about all of those."}}
{"actor":{"display_login":"erayd"}}