AJV schema validation functions should be pre-compiled to avoid unsafe-eval CSP requirement
See original GitHub issueDescribe the Bug
Compiling the AJV schema validation functions at runtime uses new new Function
which requires the CSP script-src
to include 'unsafe-eval'
.
Instead, the schema validation functions should be pre-compiled.
Steps to Reproduce
- Use the cloudevents/sdk-javascript library in a site with a CSP with
script-src
not including'unsafe-eval'
- Use
new CloudEvent(...)
- Observe CSP error
Expected Behavior
The library should be able to be used successfully without including 'unsafe-eval'
in your CSP.
Additional context See https://github.com/ajv-validator/ajv/blob/master/docs/security.md#content-security-policy
Issue Analytics
- State:
- Created 2 years ago
- Comments:5 (5 by maintainers)
Top Results From Across the Web
Use with CSP & Unsafe-Eval #406 - ajv-validator/ajv - GitHub
I see that AJV uses eval in the source to compile the Schema object. Is it possible to provide AJV with some sort...
Read more >Security considerations - Ajv JSON schema validator
Some keywords in JSON Schemas can lead to very slow validation for certain data ... Security Policy (CSP), script-src directive must include 'unsafe-eval'...
Read more >Standalone validation code - Ajv JSON schema validator
Ajv supports generating standalone validation functions from JSON Schemas at compile/build time. These functions can then be used during runtime to do ...
Read more >Managing schemas - Ajv JSON schema validator
Managing schemas. Re-using validation functions; Standalone validation code; Compiling during initialization; Using Ajv instance cache.
Read more >Execution environments - Ajv JSON schema validator
Even if your schemas need to be stored in the database, you can still compile schemas once and store your validation functions alongside...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
I have been working on this, but am awaiting some response from the ajv team https://github.com/ajv-validator/ajv/issues/1837
This issue is stale because it has been open 30 days with no activity.