Kong / Kong/httpsnippet

Pre-compile HAR schema for validation

Offen
#270 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
TypeScript
Sterne
1.2k
Forks
242
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

`Ajv` is currently used in `httpsnippet` for [validating the HAR schema passed](https://github.com/Kong/httpsnippet/blob/f64080d7d5057b2df9d4223839e001ca8009afa5/src/helpers/har-validator.ts#L21). Using complete Ajv dependency makes `httpsnippet` require `'unsafe-eval` in the CSP policy, which is a security concern. (https://github.com/ajv-validator/ajv/blob/c3e203c2696e42ec107fe6a5a659fca54b2e4993/docs/security.md#content-security-policy).

As a workaround, since the schema for HAR is known (and already included), it can be pre-compiled into a validation function as part of the build. The [Ajv Docs](https://github.com/ajv-validator/ajv-cli#compile-schemas) have details on the same.

This would move Ajv from a runtime dependency to a optional developer-dependency (as Ajv-cli) - only needed when `har-schema` is updated. This would bring a lot more benefits, including performance and bundle size improvements.

This request comes [via the Stoplight Elements](https://github.com/stoplightio/elements/issues/2141) project, which uses `httpsnippet` internally. Since httpsnippet doesn't offer a way to pre-compile schemas, this ends up breaking Elements in configurations which limit `unsafe-eval` via CSP.

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start with src/helpers/har-validator.ts and inspect how the included HAR schema is currently validated. Read the Ajv CLI compile-schemas guidance and the repository's build configuration to identify where generated validation code belongs. Done means validation no longer requires runtime Ajv or unsafe-eval, Ajv is only an optional development dependency, and the existing validation tests pass.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
typescript
Bereich
build-system, security
Issue-Typ
Feature
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Veraltet
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
35/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.