False negative: mutually exclusive cases of oneOf all match

[reitzig]

The following pair should validate:

• Schema

• JSON:

  {
    "registrationInfo": {
      "hashedPassword": "ebddbb3dc29933b9e1cc995ca466cd15",
      "hashedPuk": "ebddbb3dc29933b9e1cc995ca466cd15",
      "encryptedPuk": "ebddbb3dc29933b9e1cc995ca466cd15ebddbb3dc29933b9e1cc995ca466cd15",
      "pukedPrivateKey": {
        "iter": 16,
        "salt": "9a55653bcdaab21d6800185934008c2c1a0046160d00230b280069211480b410",
        "key" : "jnfhxIujfbSNlARE48RFrlLXMfbqxxum2cKaiYXVZe+e9z3vEQffRZo1M6p3oLVaEWE59ZQGVabCslFRAtP0BMO3oJrn7drTxWeyHCBVyuARzp/LA4CnS+vuRBWijOQE7kKXLtcACtHXEs77+CuTVzu0Y/mjIOCbqpLKsSp0PfB1X0U3z5yGKqhYQLkF6FOVmWiViyJ/WUOYiQr813721Vv7SdJpcUQl+Iom0n9R8WVVp+GMWnrcOSPCmAac9rfpgajqqprIo4PklWTOA077bIetSbnXT/Fe5J3uRMUBnehwlkeTtpf1a32Ld9f4Lb0PvnUEtw0JwtKars8tfI9dNg5UsTozJ3DSfguK7+OghLaz9rF0CMyw6230YBHLs7VD5tahXCdJWK80s9KuWvPe0DbUcnzPVnnZr/nFLM4l4xnw6wSd7FizQ6jL0TKybiE2+AllKvFxizdVEtpZ55n/M0M4FD2vCTamMIFQu+A8djD/nE5Gq7Y4qVV/7ENz6duXilbqHDUX9wEKhDngVGMdd6F8d5meAun4tURiRfG35W3ItTjO+FMTFqYlMq5ig/JvRezcUxYrEtPinMxVctHBWEYnl43PZStXABufvto50hxqH0GHHEp/HJdPd1h1HM78JI+Fm2paGj8GdtmYazyhA1+GSxuSVcgiG9vwjxGoZpHDXKwnvrDmRPKGmrsdhJRC75pDo2o7jBqinVLtjdz+EXOOOdZVJ7cS7NcstZVV1TExDGoe0RI25DaTiF5fSBOJnl/lQExrWnS0AKruOe9gQ6WV63pOlL/DSIvuEN4C028I0X+Cz2ejgyyIpHa1nJTRQFaVmcRDUFdkthwdTyXiEfx/vffAkCbFX4t0yWOYirL0rumIxd2IyYvfSclV4hFP2VbsN2Xy2reCStXXLRfNaXBwaKaiNvA6jvWnLr9/BDbK2zP5B9AFU4prfQrj6aWwaNPsn76szSaIWP5mq8xXhmHZKleeQocjNxIEfLsF7xBEOuanjlgzPAtWMsjKHFNV3NHyaMwxOE2+Fj43DYHgPtZQgBF8mYRZ8DMPCGLlap6fh9lnLOSBAGRG64CMVnkqL1KFgUN+MNHq5igQvTFJBA+7kIskrCNN9zaVyUpB1K6e+9KO8Q06YIqx2OGc6D84SXYC21Gu0jpezRUKKBy0oiRP/Jlm3XwszJHMNnMb+CdAzhgdS71YUCmac2oYNS3Ve5f7ASRVmYKbJkAiVCzC+qy9reVnUnXJKnLJ4FmOUyOr99M5zZDZ14ASs8sF2jOqeKxQgSTw2usCtvstEodunpGeKWv1Q8C1r7/IfAIJ8NiA0+Iacxq8V8trnL7QoFRDl3QDs1BTjT6prqm92MoggrqgMtlniAZdY8inWoAIDDSH7JhbgQPCwAald25x8Gs8/HY7AAck4JOFSOVGy5WhnHnWQondFXwOw3p1J6ZdkotqOY1guSGCiYa7K4d2ppMX6YVI+fJsv0ab12DQwL/YOskSMDyPh2Hhmlf7jdY0KGNcaAgd7JrgFw1TGLWrx4B58XDpPNw1DPkGS5cHZgoHbmxSEJW1KQGLMNmbpc9cCmOWeuWXJBHD+AHIjfneUXs5pQpuG3O0xB4vbVYArJv6+MhiFCm3xomWHzIVPVK8YliN6Ux+nxAM/eo3JaxbQgS5Ljqb1QMRCvesVJ8n6no7QvcXojsqEfoZpaS5hPMhWXDvQhDWfp6PZhEZYlgquFYbRwdAWrHbUc8U7DfgyoHghBn6KrH3bby8d4QAqBo6oqs4+aP7M36EJ484fLu66wTiDw3dPdaG9X2S68l/nYka+snUpIB6xAfrGUYTWqrJXvmWlpYFZy0450LlRDlPAb5Jo67Kk6YnjFrvH4M4f6z34UIAWcA+04Ykc46ZTHWy17h3oe6n/E76lI1YkLRCnwLU9J99kzdgzTlGv4eLyWuJkso+vFvWiQb4+hgYG8OfsjkfCVKM/AdfyQBdbOlT6DfSh321vQd+8TI3hWNOul+P5nG1TMkx0IB26nvwRlKq9I1yL3KnBN+wquDJ6CVxAR8cNauLqBp+eMqS3965rDqeQ7vw7qzZi8ZHbuprn/PEcTicuG4eLP77KIRdIr6G+jJl5a1hFbdcl3a9IkvgCtv2h5nOSyEGEDB3itseAlGMHqROO1riT9naKa1i3T8LHhcUwDmFJanlC1mouSfOUUKT9J4T+Ow5JOXLLGAS+F5cGqlEtqpZbpIuLPdvDCJ3/7if6BEOOQYithQkBoLJuBAgmHAFtYtszJ89e2H8h2Q6WTGgBN/Hx6ZT/EBngt+BDYuRpnkCt1QtyL6BG3dM+S66HxdZi7PId7N2o7iWJi8dfegoZW5RZgqjozDGzpyd/+qF4bv01sfUEdzSsgxNcCMft2R/SnWc+biZkkneSsNvahzZCpEXlOpHN9HPqTGR+i24E+jCdFWwG79SLLOatBd4h6tHKBImulobzu9iXpuyTorIrTlVFUx6+ZAnHA6gvN36JrMPmqUGox/b8dh7zGIHTEu5/EdQWD92ocoOdIPWxR655gdM/anXLPYhGEJ68YHZ2k0Wg+DrdgNdAhVveI/xfqpOSW0oNjlg/8/10oOA8EAoTJMUPf6qOzM9yECWom4kWl/LN1j9OGDrf/ua+paQl4tODPLcJF8t4N5BbM+aEtvaoepJ9vykGZtIJdELS7jxbM5Bhja6Hts7oz+mmcqdtmbmeMm2T4YKgwBgt5E/wzSiqolTzpTtQ4HxEze4eujF4JsNk+zJJyYtmp9gK84HyhnNSCaaHgE8Qsc0LGWETrU66Hnmq8luER+Knz5ewm+ZU9iSkW5GwrPRj89r/U3zXrz5mPNb2YehxXy99xFB4XKUyHHso6dux1ppI6kvpOCjHxNEhAzxygadio/PPvx2NNYdCkA/Bt0vBmMerc2kkyfGkpxeuyl09Y6+NWCYXAXaanxQi9qsKc7y9eCIzKCbyI0RnnQGWI6Jk9TsMthZMNaC63DAM1XKXx68j7E/FoLb4KkUxchDA9BHgiFdwq2sJrW8qAXLgjxLLen0xTXQjwX0j7LYgAfgHZUBllOacnEuqrJC8UTQhnSeSoeKIGxGRk4zbHaCYBtHMz/p1CdIa/pDsw5W9F0OtBD8I0XNdc3vzJhjGGR1wB3WN6OMUiBNiOHuyu0RRX1bxA==",
        "iv"  : "ebddbb3dc29933b9e1cc995ca466cd15"
      }
    },
    "user": {
      "identifier": "[email protected]",
      "memberType": "patient",
      "birthdate" : "1968-12-31T23:00:00Z",
      "sex"       : "m",
      "key": {
        "private": {
          "iter": 16,
          "salt": "9a55653bcdaab21d6800185934008c2c1a0046160d00230b280069211480b410",
          "key" : "jnfhxIujfbSNlARE48RFrlLXMfbqxxum2cKaiYXVZe+e9z3vEQffRZo1M6p3oLVaEWE59ZQGVabCslFRAtP0BMO3oJrn7drTxWeyHCBVyuARzp/LA4CnS+vuRBWijOQE7kKXLtcACtHXEs77+CuTVzu0Y/mjIOCbqpLKsSp0PfB1X0U3z5yGKqhYQLkF6FOVmWiViyJ/WUOYiQr813721Vv7SdJpcUQl+Iom0n9R8WVVp+GMWnrcOSPCmAac9rfpgajqqprIo4PklWTOA077bIetSbnXT/Fe5J3uRMUBnehwlkeTtpf1a32Ld9f4Lb0PvnUEtw0JwtKars8tfI9dNg5UsTozJ3DSfguK7+OghLaz9rF0CMyw6230YBHLs7VD5tahXCdJWK80s9KuWvPe0DbUcnzPVnnZr/nFLM4l4xnw6wSd7FizQ6jL0TKybiE2+AllKvFxizdVEtpZ55n/M0M4FD2vCTamMIFQu+A8djD/nE5Gq7Y4qVV/7ENz6duXilbqHDUX9wEKhDngVGMdd6F8d5meAun4tURiRfG35W3ItTjO+FMTFqYlMq5ig/JvRezcUxYrEtPinMxVctHBWEYnl43PZStXABufvto50hxqH0GHHEp/HJdPd1h1HM78JI+Fm2paGj8GdtmYazyhA1+GSxuSVcgiG9vwjxGoZpHDXKwnvrDmRPKGmrsdhJRC75pDo2o7jBqinVLtjdz+EXOOOdZVJ7cS7NcstZVV1TExDGoe0RI25DaTiF5fSBOJnl/lQExrWnS0AKruOe9gQ6WV63pOlL/DSIvuEN4C028I0X+Cz2ejgyyIpHa1nJTRQFaVmcRDUFdkthwdTyXiEfx/vffAkCbFX4t0yWOYirL0rumIxd2IyYvfSclV4hFP2VbsN2Xy2reCStXXLRfNaXBwaKaiNvA6jvWnLr9/BDbK2zP5B9AFU4prfQrj6aWwaNPsn76szSaIWP5mq8xXhmHZKleeQocjNxIEfLsF7xBEOuanjlgzPAtWMsjKHFNV3NHyaMwxOE2+Fj43DYHgPtZQgBF8mYRZ8DMPCGLlap6fh9lnLOSBAGRG64CMVnkqL1KFgUN+MNHq5igQvTFJBA+7kIskrCNN9zaVyUpB1K6e+9KO8Q06YIqx2OGc6D84SXYC21Gu0jpezRUKKBy0oiRP/Jlm3XwszJHMNnMb+CdAzhgdS71YUCmac2oYNS3Ve5f7ASRVmYKbJkAiVCzC+qy9reVnUnXJKnLJ4FmOUyOr99M5zZDZ14ASs8sF2jOqeKxQgSTw2usCtvstEodunpGeKWv1Q8C1r7/IfAIJ8NiA0+Iacxq8V8trnL7QoFRDl3QDs1BTjT6prqm92MoggrqgMtlniAZdY8inWoAIDDSH7JhbgQPCwAald25x8Gs8/HY7AAck4JOFSOVGy5WhnHnWQondFXwOw3p1J6ZdkotqOY1guSGCiYa7K4d2ppMX6YVI+fJsv0ab12DQwL/YOskSMDyPh2Hhmlf7jdY0KGNcaAgd7JrgFw1TGLWrx4B58XDpPNw1DPkGS5cHZgoHbmxSEJW1KQGLMNmbpc9cCmOWeuWXJBHD+AHIjfneUXs5pQpuG3O0xB4vbVYArJv6+MhiFCm3xomWHzIVPVK8YliN6Ux+nxAM/eo3JaxbQgS5Ljqb1QMRCvesVJ8n6no7QvcXojsqEfoZpaS5hPMhWXDvQhDWfp6PZhEZYlgquFYbRwdAWrHbUc8U7DfgyoHghBn6KrH3bby8d4QAqBo6oqs4+aP7M36EJ484fLu66wTiDw3dPdaG9X2S68l/nYka+snUpIB6xAfrGUYTWqrJXvmWlpYFZy0450LlRDlPAb5Jo67Kk6YnjFrvH4M4f6z34UIAWcA+04Ykc46ZTHWy17h3oe6n/E76lI1YkLRCnwLU9J99kzdgzTlGv4eLyWuJkso+vFvWiQb4+hgYG8OfsjkfCVKM/AdfyQBdbOlT6DfSh321vQd+8TI3hWNOul+P5nG1TMkx0IB26nvwRlKq9I1yL3KnBN+wquDJ6CVxAR8cNauLqBp+eMqS3965rDqeQ7vw7qzZi8ZHbuprn/PEcTicuG4eLP77KIRdIr6G+jJl5a1hFbdcl3a9IkvgCtv2h5nOSyEGEDB3itseAlGMHqROO1riT9naKa1i3T8LHhcUwDmFJanlC1mouSfOUUKT9J4T+Ow5JOXLLGAS+F5cGqlEtqpZbpIuLPdvDCJ3/7if6BEOOQYithQkBoLJuBAgmHAFtYtszJ89e2H8h2Q6WTGgBN/Hx6ZT/EBngt+BDYuRpnkCt1QtyL6BG3dM+S66HxdZi7PId7N2o7iWJi8dfegoZW5RZgqjozDGzpyd/+qF4bv01sfUEdzSsgxNcCMft2R/SnWc+biZkkneSsNvahzZCpEXlOpHN9HPqTGR+i24E+jCdFWwG79SLLOatBd4h6tHKBImulobzu9iXpuyTorIrTlVFUx6+ZAnHA6gvN36JrMPmqUGox/b8dh7zGIHTEu5/EdQWD92ocoOdIPWxR655gdM/anXLPYhGEJ68YHZ2k0Wg+DrdgNdAhVveI/xfqpOSW0oNjlg/8/10oOA8EAoTJMUPf6qOzM9yECWom4kWl/LN1j9OGDrf/ua+paQl4tODPLcJF8t4N5BbM+aEtvaoepJ9vykGZtIJdELS7jxbM5Bhja6Hts7oz+mmcqdtmbmeMm2T4YKgwBgt5E/wzSiqolTzpTtQ4HxEze4eujF4JsNk+zJJyYtmp9gK84HyhnNSCaaHgE8Qsc0LGWETrU66Hnmq8luER+Knz5ewm+ZU9iSkW5GwrPRj89r/U3zXrz5mPNb2YehxXy99xFB4XKUyHHso6dux1ppI6kvpOCjHxNEhAzxygadio/PPvx2NNYdCkA/Bt0vBmMerc2kkyfGkpxeuyl09Y6+NWCYXAXaanxQi9qsKc7y9eCIzKCbyI0RnnQGWI6Jk9TsMthZMNaC63DAM1XKXx68j7E/FoLb4KkUxchDA9BHgiFdwq2sJrW8qAXLgjxLLen0xTXQjwX0j7LYgAfgHZUBllOacnEuqrJC8UTQhnSeSoeKIGxGRk4zbHaCYBtHMz/p1CdIa/pDsw5W9F0OtBD8I0XNdc3vzJhjGGR1wB3WN6OMUiBNiOHuyu0RRX1bxA==",
          "iv"  : "ebddbb3dc29933b9e1cc995ca466cd15"
        },
        "method" : "RSA",
        "public" : {
          "mod": "9de8ff27c122778da5d1fd9533a53f0d01762171a702ff8bf5e4086d2a19904d3667e694823f8ac007037d7199b13bcfccfceaff314d5841c625c51e20cbe2b3b712f214bff5fd241c717f220f6f547edbda574e1899f1e3b7c34e8ea78f039619a63a5fc7fb3515608defa2b634b02c62af580e87827761d9b2a4730385f3387cad2d3968b5d23fe769c31794410f28a5c976ef7c3288ece42293ec375ca0dbd317a67e3fc4acd57b474417e615320431c828f3764099b0c4ca75f2d917ba63f60629fddb66a6f468eddeef305648e07b3980b006b1520c7027fbd64b5150801a4bdf54c8dcb470e3a5945921dd91099a1c7bce195acb02209f7d92af5ed5f5",
          "exp": "010001"
        }
      }
    }
  }

For reference, this exact pair validates with Ruby's json-schema.

However, with json-schema-validator (2.2.10) I get:

instance failed to match exactly one schema (matched 3 out of 3)

There are two three-way oneOfs in this schema:

• A case distinction over patient, physician, and staff (see top-level schema) -- but those schemas (given by reference) have mutually exclusive singleton enum properties, e.g.

  "memberType": {
    "enum": ["patient"]
  }

  for patient, and similar for the other two types.

• Different combinations of method and methodId in the referenced member-key schema. There, we have three cases like so:

    "properties" : {
      "method"  : {
        "type": "string",
        "enum": ["RSA"]
      },
      "methodId": {
        "type": "integer",
        "enum": [2]
      }
    },
    "required"   : [
      "method",
      "methodId"
    ]
  
  <snip>
  
    "properties" : {
      "method"  : {
        "type": "string",
        "enum": ["RSA"]
      },
      "methodId": {
        "not": {}
      }
    },
    "required"   : [
      "method"
    ]
  
  <snip>
  
    "properties" : {
      "method"  : {
        "type": "integer",
        "enum": [2]
      }
    },
    "required"   : [
      "method"
    ]

  Again, we see that the three cases are mutually exclusive.

In summary, it is impossible for any JSON to cause this error (and the given one certainly doesn't),
There must be a bug in the validator.

[reitzig]

This may be related to json-schema-org/json-schema-spec/issues#672, in which case it's not a bug at all but the specified (or at least intended, at draft 4) behaviour.

[reitzig]

I have confirmed that with the corrected schema the result is as expected. My apologies.