Resolver function for external $ref URIs.
Called with the URI portion (everything before #) of an external ref.
Returns the parsed document (JSON object) or undefined.
Security warning — SSRF and local-file disclosure
Consumers MUST validate the URI before fetching the target document.
schema-components hands the resolver the raw $ref URI from the
document — which is typically user-controlled — and any network or
filesystem access the resolver performs runs with the host
application's full privileges. An attacker-crafted schema that
references an internal endpoint or a local filesystem path will
happily exfiltrate or expose data the application never intended to
surface.
At a minimum the resolver should:
Refuse non-https: schemes by default. Permit http: only on an
explicit allow-list. Refuse file:, data:, javascript:,
ftp:, gopher:, and every other scheme outright.
Resolve the URI's hostname and refuse loopback addresses
(127.0.0.0/8, ::1), link-local addresses (169.254.0.0/16,
fe80::/10), private ranges (10.0.0.0/8, 172.16.0.0/12,
192.168.0.0/16, fc00::/7), and cloud-metadata IPs
(169.254.169.254, fd00:ec2::254).
Apply a strict allow-list of permitted hosts where possible.
Set request timeouts and a maximum response size.
Disable HTTP redirects, or re-validate the redirected URL against
the same denylist before following.
Reject responses that are not application/json or
application/yaml.
schema-components performs no validation itself — that responsibility
sits exclusively with the resolver implementation supplied by the
caller.
Resolver function for external $ref URIs. Called with the URI portion (everything before
#) of an external ref. Returns the parsed document (JSON object) or undefined.Security warning — SSRF and local-file disclosure
Consumers MUST validate the URI before fetching the target document. schema-components hands the resolver the raw
$refURI from the document — which is typically user-controlled — and any network or filesystem access the resolver performs runs with the host application's full privileges. An attacker-crafted schema that references an internal endpoint or a local filesystem path will happily exfiltrate or expose data the application never intended to surface.At a minimum the resolver should:
https:schemes by default. Permithttp:only on an explicit allow-list. Refusefile:,data:,javascript:,ftp:,gopher:, and every other scheme outright.127.0.0.0/8,::1), link-local addresses (169.254.0.0/16,fe80::/10), private ranges (10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7), and cloud-metadata IPs (169.254.169.254,fd00:ec2::254).application/jsonorapplication/yaml.schema-components performs no validation itself — that responsibility sits exclusively with the resolver implementation supplied by the caller.