Bug #115429 JSON_SCHEMA_VALID doesn't validate exclusiveMinimum

• Submitted: 25 Jun 12:54
• Modified: 26 Jun 8:24
• Reporter: Daniël van Eeden (OCA)
• Status: Duplicate
• Category: MySQL Server: JSON
• Severity: S2 (Serious)
• Version: 8.4.0
• OS: Any
• CPU Architecture: Any
• Tags: json, json schema, Validation

[25 Jun 12:54] Daniël van Eeden

Description:
The spec says that exclusiveMinimum should be a number defining an explicit lower limit. It looks like MySQL doesn't validate this.
It looks like there isn't a warning/error for this.
In addition to that it looks like it accepts non-number arguments.

https://json-schema.org/draft/2020-12/json-schema-validation#name-exclusiveminimum

How to repeat:
mysql-8.4.0> SELECT JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": 5}}}', '{"a": 3}');
+---------------------------------------------------------------------------------+
| JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": 5}}}', '{"a": 3}') |
+---------------------------------------------------------------------------------+
|                                                                               1 |
+---------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql-8.4.0> SELECT JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": 5}}}', '{"a": 6}');
+---------------------------------------------------------------------------------+
| JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": 5}}}', '{"a": 6}') |
+---------------------------------------------------------------------------------+
|                                                                               1 |
+---------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql-8.4.0> SELECT JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": "maybe"}}}', '{"a": 6}');
+---------------------------------------------------------------------------------------+
| JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": "maybe"}}}', '{"a": 6}') |
+---------------------------------------------------------------------------------------+
|                                                                                     1 |
+---------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql-8.4.0> SELECT JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": null}}}', '{"a": 6}');
+------------------------------------------------------------------------------------+
| JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": null}}}', '{"a": 6}') |
+------------------------------------------------------------------------------------+
|                                                                                  1 |
+------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql-8.4.0> SELECT JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": false}}}', '{"a": 6}');
+-------------------------------------------------------------------------------------+
| JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": false}}}', '{"a": 6}') |
+-------------------------------------------------------------------------------------+
|                                                                                   1 |
+-------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql-8.4.0> SELECT JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": []}}}', '{"a": 6}');
+----------------------------------------------------------------------------------+
| JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": []}}}', '{"a": 6}') |
+----------------------------------------------------------------------------------+
|                                                                                1 |
+----------------------------------------------------------------------------------+
1 row in set (0.00 sec)

Suggested fix:
Correct validation of exclusiveMinimum

[25 Jun 12:55] Daniël van Eeden

Might be a duplicate of https://bugs.mysql.com/bug.php?id=106454

[25 Jun 13:01] Daniël van Eeden

https://dev.mysql.com/doc/refman/8.4/en/json-validation-functions.html says "MySQL supports validation of JSON documents against JSON schemas conforming to Draft 4 of the JSON Schema specification." 

And on https://json-schema.org/draft-04/draft-fge-json-schema-validation-00#rfc.section.5.1.3 it states that exclusiveMinimum should be a number and that minimum should also be present.

The following seems to match this:

mysql-8.4.0> SELECT JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": true, "minimum": 6}}}', '{"a": 6}');
+--------------------------------------------------------------------------------------------------+
| JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": true, "minimum": 6}}}', '{"a": 6}') |
+--------------------------------------------------------------------------------------------------+
|                                                                                                0 |
+--------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql-8.4.0> SELECT JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": false, "minimum": 6}}}', '{"a": 6}');
+---------------------------------------------------------------------------------------------------+
| JSON_SCHEMA_VALID('{"properties": {"a": {"exclusiveMinimum": false, "minimum": 6}}}', '{"a": 6}') |
+---------------------------------------------------------------------------------------------------+
|                                                                                                 1 |
+---------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

However invalid values for exclusiveMinimum are still silently accepted.

[26 Jun 8:24] MySQL Verification Team

Hello Daniël,

Thank you for the report and feedback.
Agree, this is duplicate of Bug #106454.

Sincerely,
Umesh