ajv-validator / ajv-validator/ajv

Separate `eval` (`new Function`) from `sourceCode` generation (`CodeGen`)

Offen
#2,527 6 Kommentare 11 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
enhancement
Vorherrschende Sprache
TypeScript
Sterne
14.8k
Forks
1k
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

### What version of Ajv are you using?
8.17.1

### What problem do you want to solve?

Currently, using AJV on sites with Content Security Policy (CSP) rules that disallow `unsafe-eval` is not feasible due to its reliance on `new Function`. This limitation is documented here: https://ajv.js.org/security.html#content-security-policy

And the suggested approach around this limitation is a two-step process:
1. Generate the `sourceCode` for the schema validation.
2. Serve the `sourceCode` as a standard `.js` file, which can then be included alongside other JavaScript assets on the site.

However, unfortunately, **purely doing the first step—JUST generating the `sourceCode`—is currently impossible too**. Because `compileSchema()` generates the `sourceCode` but immediately attempts to create the `validate` function using `new Function()`, which violates CSP rules:

https://github.com/ajv-validator/ajv/blob/82735a15826a30cc51e97a1bbfb59b3d388e4b98/lib/compile/index.ts#L167-L172

While in this two-step process, **the `validate` function isn't needed at all**, during the first step. (Additionally, this is an extra work).

And the problem is in our case, we do the job in a service-worker which is subject to CSP regulations itself and so it can't execute `eval()` (or `new Function()`).

### What do you think is the correct solution to the problem?

Introduce a dedicated, pure function that generates only the `sourceCode`. This function should work independently of `compileSchema` and should not attempt to create a `validate` function. Such a function would be compatible with CSP-bound environments and could be used by both `compileSchema` and developers needing `sourceCode` generation.

### Will you be able to implement it?
Probably yes.

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.