[RSS] JSON Schema References Considered Harmful
https://www.svix.com/blog/json-schema-external-entities/While I kind of agree with the title, the article is mostly explaining how hitting their finger is the hammers fault. This is the gist:
"[Rust jsonschema] automatically (and, as of v0.21.0, eagerly) handles dereferencing $ref entries, including fetching arbitrary HTTP Resources and loading files off of disk if a file:/// URI is specified. If a resource doesn't include a valid JSON Schema document, the error message will include fragments of the affected document."
In other words jsonschema follows the spec, which they didn't read before implementing arbitrary schema upload+parsing.