From d4a17477b0b5beb9737460f910538eebbea04ca6 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 29 May 2026 04:25:04 -0400
Subject: [PATCH] fix(schema): reject noncanonical array refs

---
 src/plugins/schema-validator.test.ts | 7 +++++++
 src/shared/json-schema-defaults.ts   | 5 +++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/plugins/schema-validator.test.ts b/src/plugins/schema-validator.test.ts
index b17584d6be7..c7016bc5021 100644
--- a/src/plugins/schema-validator.test.ts
+++ b/src/plugins/schema-validator.test.ts
@@ -313,6 +313,13 @@ describe("schema validator", () => {
           $ref: "#/$defs/Missing",
         },
       ],
+      [
+        "schema-validator.test.invalid-array-ref-leading-zero",
+        {
+          anyOf: [{ type: "number" }, { type: "string" }],
+          $ref: "#/anyOf/01",
+        },
+      ],
       [
         "schema-validator.test.invalid-dynamic-ref-type",
         {
diff --git a/src/shared/json-schema-defaults.ts b/src/shared/json-schema-defaults.ts
index 78bfe799d6d..a0d71e5c725 100644
--- a/src/shared/json-schema-defaults.ts
+++ b/src/shared/json-schema-defaults.ts
@@ -1,5 +1,6 @@
 import { Compile } from "typebox/compile";
 import type { JsonSchemaObject } from "./json-schema.types.js";
+import { parseConfigPathArrayIndex } from "./path-array-index.js";
 
 type JsonSchemaValue = JsonSchemaObject | boolean;
 type LocalRefResolution =
@@ -304,8 +305,8 @@ function resolveLocalRef(
     let currentResourceBaseId = resourceBaseId;
     for (const segment of ref.slice(2).split("/").map(decodePointerSegment)) {
       if (Array.isArray(current)) {
-        const index = Number(segment);
-        if (!Number.isInteger(index) || index < 0) {
+        const index = parseConfigPathArrayIndex(segment);
+        if (index === undefined) {
           return { found: false };
         }
         current = current[index];