Kong / Kong/httpsnippet

Pre-compile HAR schema for validation

未關閉
#270 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
TypeScript
星號
1.2k
分支
242
PR 合併指標
30 天內沒有已合併 PR

描述

`Ajv` is currently used in `httpsnippet` for [validating the HAR schema passed](https://github.com/Kong/httpsnippet/blob/f64080d7d5057b2df9d4223839e001ca8009afa5/src/helpers/har-validator.ts#L21). Using complete Ajv dependency makes `httpsnippet` require `'unsafe-eval` in the CSP policy, which is a security concern. (https://github.com/ajv-validator/ajv/blob/c3e203c2696e42ec107fe6a5a659fca54b2e4993/docs/security.md#content-security-policy).

As a workaround, since the schema for HAR is known (and already included), it can be pre-compiled into a validation function as part of the build. The [Ajv Docs](https://github.com/ajv-validator/ajv-cli#compile-schemas) have details on the same.

This would move Ajv from a runtime dependency to a optional developer-dependency (as Ajv-cli) - only needed when `har-schema` is updated. This would bring a lot more benefits, including performance and bundle size improvements.

This request comes [via the Stoplight Elements](https://github.com/stoplightio/elements/issues/2141) project, which uses `httpsnippet` internally. Since httpsnippet doesn't offer a way to pre-compile schemas, this ends up breaking Elements in configurations which limit `unsafe-eval` via CSP.

貢獻指南

開啟貢獻指南

研究方向

Start with src/helpers/har-validator.ts and inspect how the included HAR schema is currently validated. Read the Ajv CLI compile-schemas guidance and the repository's build configuration to identify where generated validation code belongs. Done means validation no longer requires runtime Ajv or unsafe-eval, Ajv is only an optional development dependency, and the existing validation tests pass.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
typescript
領域
build-system, security
Issue 類型
功能
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。