Validator considers the validation result valid if the schema is passed as a string value.

[smilesrg]

If the schema is passed as a string value, no warnings/errors/exceptions happen, and the validation result is always valid.

[erayd]

A string isn't a valid schema. It needs to be either an object or a boolean. It's likely that it's being interpreted as boolean true, and this is why it's returning as valid.

An appropriate fix for this would be to either throw an error in the event of an invalid type being passed as the schema parameter, or expand the functionality to attempt a JSON decode on it if the type is a string (which would technically be noncompliant, but might be a better match to new user expectations).

[erayd]

One other reason why this might return valid is that JSON schema validation is a default-valid system - that is, if there is no rule in the schema to prevent something in the data instance, then that data is considered valid. So if the string is simply being treated as "not a schema", then trying to validate a data instance against it will (correctly, but perhaps unexpectedly) pass.

[DannyvdSluijs]

Hi @smilesrg

I was planning to look into this but in order to get started it would be very helpful to provide some reproduction steps.
Hoping you can add them to this issue?

As Erayd mentioned schema's should be a boolean or object. Currently we also accept associative arrays but there are plans to drop that as it creates more issues than it solves. Also note that boolean schema's are only support draft-06 and above, which effectively means this library doesn't support boolean schema (yet).

An appropriate fix for this would be to either throw an error in the event of an invalid type being passed as the schema parameter, or expand the functionality to attempt a JSON decode on it if the type is a string (which would technically be noncompliant, but might be a better match to new user expectations).

We could use some of the feature flags in the config for this perhaps. Adding a strict option (off by default) to do these type of checks.