Disable additionalProperties in slots, props in SDC json schema

Created on 18 April 2025, 4 days ago

Problem/Motivation

While debugging the slots/variants schemas Introduce component variants to SDC Active with @larowlan, we found out that

"patternProperties": {
        "^[a-zA-Z0-9_-]+$": {

means that whatever fits this regex is going to be validated against it.

But there could be additional properties!

I think we are missing additionalProperties: false in our schemas. @wimleers confirmed this finding.

Steps to reproduce

TBD

Proposed resolution

TBD

Remaining tasks

TBD

User interface changes

TBD

Introduced terminology

TBD

API changes

TBD

Data model changes

TBD

Release notes snippet

TBD

🐛 Bug report
Status

Active

Version

11.0 🔥

Component

theme system

Created by

🇪🇸Spain penyaskito Seville 💃, Spain 🇪🇸, UTC+2 🇪🇺

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @penyaskito
  • 🇧🇪Belgium wim leers Ghent 🇧🇪🇪🇺

    Great find! 🤩

    The best part: this should not require any update path, nor is it a BC break; this is just tightening SDC's existing JSON Schema! 👏

  • 🇪🇸Spain penyaskito Seville 💃, Spain 🇪🇸, UTC+2 🇪🇺
  • 🇪🇸Spain penyaskito Seville 💃, Spain 🇪🇸, UTC+2 🇪🇺
  • 🇪🇸Spain penyaskito Seville 💃, Spain 🇪🇸, UTC+2 🇪🇺

    So we can do this for slots, because we have our own slotDefinition, but not for props, that are using http://json-schema.org/draft-04/schema#: see https://github.com/orgs/json-schema-org/discussions/502#discussioncommen....

    Maybe we can use allOf instead of $ref here.

  • Pipeline finished with Failed
    about 16 hours ago
    Total: 574s
    #478279
  • Pipeline finished with Failed
    about 15 hours ago
    Total: 196s
    #478286
  • 🇪🇸Spain penyaskito Seville 💃, Spain 🇪🇸, UTC+2 🇪🇺

    Added 📌 Twig disallows dashes in variable names, so SDC should disallow it in prop names Active as related.

    allOf didn't work, as this is an object not an array, so reverted that.

    Added a test with invalid slot name, and apparently additionalProperties is ignored, becase this test fails to trigger the expected exception.

  • Pipeline finished with Failed
    about 15 hours ago
    Total: 95s
    #478329
  • Pipeline finished with Failed
    about 14 hours ago
    Total: 101s
    #478345
  • Pipeline finished with Failed
    about 10 hours ago
    Total: 511s
    #478467
  • Pipeline finished with Failed
    about 9 hours ago
    Total: 434s
    #478483
  • 🇪🇸Spain penyaskito Seville 💃, Spain 🇪🇸, UTC+2 🇪🇺
  • Pipeline finished with Canceled
    about 9 hours ago
    Total: 1028s
    #478508
  • 🇪🇸Spain penyaskito Seville 💃, Spain 🇪🇸, UTC+2 🇪🇺

    Type was never defined in schema for slots, but some components were using it.

    I opted for removing it, as slots should be any html fragment, and we aren't validating them anyway.

  • Pipeline finished with Success
    about 9 hours ago
    Total: 409s
    #478527
  • 🇪🇸Spain penyaskito Seville 💃, Spain 🇪🇸, UTC+2 🇪🇺

    Even if this is not a BC break technically, it would be in practice, as the components I had to change in core show.

    So probably a change record won't hurt, and we might not want to cherry-pick to 11.1.

  • 🇫🇷France pdureau Paris

    Hi Penyakisto,

    Thanks you for this quick proposal.

    You added additionalProperties twice, at the upper slot names level, and at the lower slot definition level:

        "slotDefinition": {
          "type": "object",
    +      "additionalProperties": false,
          "patternProperties": {
            "^[a-zA-Z0-9_-]+$": {
              "type": "object",
    +          "additionalProperties": false,
    

    The higher level constraint is the main task of this ticket.

    Adding the lower level constraint was useful:

    • to detect some errors in Core components, where you removed the unexpected type property
    • to add the forgotten required property to the schema

    But I am still not sure it is a constraint we need to add in this MR (while keeping the other changes anyway). I will need to think a bit about that ;)

Production build 0.71.5 2024