Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

AJV schema validation functions should be pre-compiled to avoid unsafe-eval CSP requirement

See original GitHub issue

Describe the Bug Compiling the AJV schema validation functions at runtime uses new new Function which requires the CSP script-src to include 'unsafe-eval'.

Instead, the schema validation functions should be pre-compiled.

Steps to Reproduce

Use the cloudevents/sdk-javascript library in a site with a CSP with script-src not including 'unsafe-eval'
Use new CloudEvent(...)
Observe CSP error

Expected Behavior The library should be able to be used successfully without including 'unsafe-eval' in your CSP.

Additional context See https://github.com/ajv-validator/ajv/blob/master/docs/security.md#content-security-policy

Issue Analytics

State:
Created 2 years ago
Comments:5 (5 by maintainers)

Top GitHub Comments

1reaction

lancecommented, Dec 14, 2021

I have been working on this, but am awaiting some response from the ajv team https://github.com/ajv-validator/ajv/issues/1837

0reactions

github-actions[bot]commented, Feb 14, 2022

This issue is stale because it has been open 30 days with no activity.

Top Results From Across the Web

Use with CSP & Unsafe-Eval #406 - ajv-validator/ajv - GitHub

I see that AJV uses eval in the source to compile the Schema object. Is it possible to provide AJV with some sort...

Security considerations - Ajv JSON schema validator

Some keywords in JSON Schemas can lead to very slow validation for certain data ... Security Policy (CSP), script-src directive must include 'unsafe-eval'...

Standalone validation code - Ajv JSON schema validator

Ajv supports generating standalone validation functions from JSON Schemas at compile/build time. These functions can then be used during runtime to do ...

Managing schemas - Ajv JSON schema validator

Managing schemas. Re-using validation functions; Standalone validation code; Compiling during initialization; Using Ajv instance cache.

Execution environments - Ajv JSON schema validator

Even if your schemas need to be stored in the database, you can still compile schemas once and store your validation functions alongside...