Kong / Kong/httpsnippet

Pre-compile HAR schema for validation

Aberta
#270 1 comentário 0 reações 0 responsáveis Ver no GitHub
Linguagem predominante
TypeScript
Estrelas
1.2k
Forks
242
Métricas de merge de PRs
Nenhum PR com merge em 30d

Descrição

`Ajv` is currently used in `httpsnippet` for [validating the HAR schema passed](https://github.com/Kong/httpsnippet/blob/f64080d7d5057b2df9d4223839e001ca8009afa5/src/helpers/har-validator.ts#L21). Using complete Ajv dependency makes `httpsnippet` require `'unsafe-eval` in the CSP policy, which is a security concern. (https://github.com/ajv-validator/ajv/blob/c3e203c2696e42ec107fe6a5a659fca54b2e4993/docs/security.md#content-security-policy).

As a workaround, since the schema for HAR is known (and already included), it can be pre-compiled into a validation function as part of the build. The [Ajv Docs](https://github.com/ajv-validator/ajv-cli#compile-schemas) have details on the same.

This would move Ajv from a runtime dependency to a optional developer-dependency (as Ajv-cli) - only needed when `har-schema` is updated. This would bring a lot more benefits, including performance and bundle size improvements.

This request comes [via the Stoplight Elements](https://github.com/stoplightio/elements/issues/2141) project, which uses `httpsnippet` internally. Since httpsnippet doesn't offer a way to pre-compile schemas, this ends up breaking Elements in configurations which limit `unsafe-eval` via CSP.

Guia de contribuição

Abrir o guia de contribuição

Direção de pesquisa

Start with src/helpers/har-validator.ts and inspect how the included HAR schema is currently validated. Read the Ajv CLI compile-schemas guidance and the repository's build configuration to identify where generated validation code belongs. Done means validation no longer requires runtime Ajv or unsafe-eval, Ajv is only an optional development dependency, and the existing validation tests pass.

Escrita pelo modelo de indexação a partir do texto da issue.

Avaliação

Stack de tecnologia
typescript
Domínio
build-system, security
Tipo de issue
Funcionalidade
Dificuldade
4/5
Tempo estimado
3-5 dias
Status de atividade
Estagnada
Clareza
Razoavelmente clara
Facilidade para iniciantes
35/100

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.