Kong / Kong/httpsnippet

Pre-compile HAR schema for validation

未关闭
#270 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
TypeScript
星标
1.2k
派生
242
PR 合并指标
30 天内没有已合并 PR

描述

`Ajv` is currently used in `httpsnippet` for [validating the HAR schema passed](https://github.com/Kong/httpsnippet/blob/f64080d7d5057b2df9d4223839e001ca8009afa5/src/helpers/har-validator.ts#L21). Using complete Ajv dependency makes `httpsnippet` require `'unsafe-eval` in the CSP policy, which is a security concern. (https://github.com/ajv-validator/ajv/blob/c3e203c2696e42ec107fe6a5a659fca54b2e4993/docs/security.md#content-security-policy).

As a workaround, since the schema for HAR is known (and already included), it can be pre-compiled into a validation function as part of the build. The [Ajv Docs](https://github.com/ajv-validator/ajv-cli#compile-schemas) have details on the same.

This would move Ajv from a runtime dependency to a optional developer-dependency (as Ajv-cli) - only needed when `har-schema` is updated. This would bring a lot more benefits, including performance and bundle size improvements.

This request comes [via the Stoplight Elements](https://github.com/stoplightio/elements/issues/2141) project, which uses `httpsnippet` internally. Since httpsnippet doesn't offer a way to pre-compile schemas, this ends up breaking Elements in configurations which limit `unsafe-eval` via CSP.

贡献指南

打开贡献指南

调研方向

Start with src/helpers/har-validator.ts and inspect how the included HAR schema is currently validated. Read the Ajv CLI compile-schemas guidance and the repository's build configuration to identify where generated validation code belongs. Done means validation no longer requires runtime Ajv or unsafe-eval, Ajv is only an optional development dependency, and the existing validation tests pass.

由索引模型根据 Issue 内容生成。

评估

技术栈
typescript
领域
build-system, security
Issue 类型
功能
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。