Repository navigation
AJV schema validation functions should be pre-compiled to avoid unsafe-eval CSP requirement #423
Description
Describe the Bug
Compiling the AJV schema validation functions at runtime uses new new Function which requires the CSP script-src to include 'unsafe-eval'.
Instead, the schema validation functions should be pre-compiled.
Steps to Reproduce
- Use the cloudevents/sdk-javascript library in a site with a CSP with
script-srcnot including'unsafe-eval' - Use
new CloudEvent(...) - Observe CSP error
Expected Behavior
The library should be able to be used successfully without including 'unsafe-eval' in your CSP.
Additional context
See https://github.com/ajv-validator/ajv/blob/master/docs/security.md#content-security-policy
Activity
lance commentedon Aug 3, 2021
@hrobertson thanks for reporting this.
See also: https://github.com/ajv-validator/ajv/blob/master/docs/standalone.md
github-actions commentedon Sep 3, 2021
This issue is stale because it has been open 30 days with no activity.
lance commentedon Dec 14, 2021
I have been working on this, but am awaiting some response from the ajv team ajv-validator/ajv#1837
github-actions commentedon Jan 14, 2022
This issue is stale because it has been open 30 days with no activity.
feat: precompile cloudevent schema
feat: precompile cloudevent schema
github-actions commentedon Feb 14, 2022
This issue is stale because it has been open 30 days with no activity.
feat: precompile cloudevent schema (#471)