Skip to content

Output schemas: use a linear-time regex engine for pattern/patternProperties #131

Open

Description

@byapparov

From the review on #129 (deferred). OutputSchema.compile passes schemas to Ajv, which compiles pattern and patternProperties into native backtracking RegExp, so a pathological pattern can stall validation of model output. The schema comes from the invoking user or workflow author, not the model, and executor runs are timeout-bounded, so the impact is a self-inflicted stalled run.

Option: Ajv's code.regExp hook with an RE2 binding (check single-binary compatibility). The executor-side checker (aictrl-output.cjs) must make the same choice so verdict parity holds.

Activity

  1. added
    securitySecurity vulnerabilities and hardening
    structured-output--output-schema / StructuredOutput mode
    P3Nice to have - Low
    on Oct 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P3Nice to have - LowsecuritySecurity vulnerabilities and hardeningstructured-output--output-schema / StructuredOutput mode

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions