Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Content Security Policy (CSP) reporting unsafe eval usage inside Chrome Extension V3 #3543

Closed
4 tasks done
fstn opened this issue Mar 26, 2023 · 6 comments · Fixed by #3652
Closed
4 tasks done

Content Security Policy (CSP) reporting unsafe eval usage inside Chrome Extension V3 #3543

fstn opened this issue Mar 26, 2023 · 6 comments · Fixed by #3652
Assignees
@heath-freenome
Labels
ajv feature Is a feature request

Comments

@fstn
Copy link

fstn commented Mar 26, 2023

Prerequisites

What theme are you using?

core

Version

5.x

Current Behavior

Same as #1121

I completely blocked because I'm developing a Chrome Extension that doesn't allow CSP, any chance to precompile schema?

Expected Behavior

No response

Steps To Reproduce

No response

Environment

- OS:
- Node:
- npm:

Anything else?

No response
@fstn fstn added bug needs triage Initial label given, to be assigned correct labels and assigned labels Mar 26, 2023
@heath-freenome
Copy link
Member

@fstn I plan on adding support for precompiled schemas before the end of April as I need it for my own purposes for exactly the same reason as you.

@heath-freenome heath-freenome added ajv feature Is a feature request and removed bug needs triage Initial label given, to be assigned correct labels and assigned labels Mar 28, 2023
@heath-freenome heath-freenome self-assigned this Mar 28, 2023
@fstn
Copy link
Author

fstn commented Mar 28, 2023

that's awesome

@rwlodarczyk-xealth
Copy link

@heath-freenome Just wondering, what is the status of this work? Still on track for end of April/early May?

@heath-freenome
Copy link
Member

heath-freenome commented Apr 27, 2023 •
edited
Loading

@rwlodarczyk-xealth I have a PR up right now that is laying the ground work for the precompiled schema-based validator (I needed to be able to parse schemas to extract the subschemas that are passed to the isValid() function of the validators). I am anticipating having this issue (i.e. adding support for precompiled validators in the validator-ajv8 package) done in less than 2 weeks.

@fregante
Copy link
Contributor

fregante commented May 3, 2023

Very related, same reason:

heath-freenome added a commit to heath-freenome/react-jsonschema-form that referenced this issue May 9, 2023
@heath-freenome
fix: Implement precompiled validator support in @rjsf/validator-ajv8
d15a9a9 
Fixes rjsf-team#3543 by implementing support for precompiled validators
- In `@rjsf/validator-ajv8` added support for precompiled validators as follows:
  - Added a new `compileSchemaValidators()` API function used to generate the precompiled validators for a schema to an output file
  - Updated the documentation for the `customizeValidator()` API function
  - Added a new `AJV8PrecompiledValidator` implementation of the `ValidatorType` interface
  - Refactored a large piece of the raw validation error processing from the `AJV8Validator` into a new `processRawValidationErrors()` function also used by the `AJV8PrecompiledValidator`
  - Added a new `usePrecompiledValidator()` API function that is similar to `customizeValidator()` but returning a precompiled validator-based `ValidatorType` interface implementation
  - Added some new types to the `types.ts` file in support of precompiled validators
  - Updated the main `index.ts` file to export the new types and API functions
  - Added 100% unit test coverage of the new feature
    - This included implementing a node function to precompile the `superSchema.json` file found in the `test/harness` directory
- Updated the `validation.md` documentation for the new precompiled validator functionality
- Added a new `validator-ajv8.md` documentation file to the `api-reference` directory and the `sidebar.js`
- Updated the `CHANGELOG.md` file accordingly
heath-freenome added a commit to heath-freenome/react-jsonschema-form that referenced this issue May 9, 2023
@heath-freenome
fix: Implement precompiled validator support in @rjsf/validator-ajv8
248d9c8 
Fixes rjsf-team#3543 by implementing support for precompiled validators
- In `@rjsf/validator-ajv8` added support for precompiled validators as follows:
  - Added a new `compileSchemaValidators()` API function used to generate the precompiled validators for a schema to an output file
  - Updated the documentation for the `customizeValidator()` API function
  - Added a new `AJV8PrecompiledValidator` implementation of the `ValidatorType` interface
  - Refactored a large piece of the raw validation error processing from the `AJV8Validator` into a new `processRawValidationErrors()` function also used by the `AJV8PrecompiledValidator`
  - Added a new `usePrecompiledValidator()` API function that is similar to `customizeValidator()` but returning a precompiled validator-based `ValidatorType` interface implementation
  - Added some new types to the `types.ts` file in support of precompiled validators
  - Updated the main `index.ts` file to export the new types and API functions
  - Added 100% unit test coverage of the new feature
    - This included implementing a node function to precompile the `superSchema.json` file found in the `test/harness` directory
- Updated the `validation.md` documentation for the new precompiled validator functionality
- Added a new `validator-ajv8.md` documentation file to the `api-reference` directory and the `sidebar.js`
- Updated the `CHANGELOG.md` file accordingly
heath-freenome added a commit to heath-freenome/react-jsonschema-form that referenced this issue May 9, 2023
@heath-freenome
fix: Implement precompiled validator support in @rjsf/validator-ajv8
06c2388 
Fixes rjsf-team#3543 by implementing support for precompiled validators
- In `@rjsf/validator-ajv8` added support for precompiled validators as follows:
  - Added a new `compileSchemaValidators()` API function used to generate the precompiled validators for a schema to an output file
  - Updated the documentation for the `customizeValidator()` API function
  - Added a new `AJV8PrecompiledValidator` implementation of the `ValidatorType` interface
  - Refactored a large piece of the raw validation error processing from the `AJV8Validator` into a new `processRawValidationErrors()` function also used by the `AJV8PrecompiledValidator`
  - Added a new `usePrecompiledValidator()` API function that is similar to `customizeValidator()` but returning a precompiled validator-based `ValidatorType` interface implementation
  - Added some new types to the `types.ts` file in support of precompiled validators
  - Updated the main `index.ts` file to export the new types and API functions
  - Added 100% unit test coverage of the new feature
    - This included implementing a node function to precompile the `superSchema.json` file found in the `test/harness` directory
- Updated the `validation.md` documentation for the new precompiled validator functionality
- Added a new `validator-ajv8.md` documentation file to the `api-reference` directory and the `sidebar.js`
- Updated the `CHANGELOG.md` file accordingly
heath-freenome added a commit to heath-freenome/react-jsonschema-form that referenced this issue May 9, 2023
@heath-freenome
fix: Implement precompiled validator support in @rjsf/validator-ajv8
421f2a4 
Fixes rjsf-team#3543 by implementing support for precompiled validators
- In `@rjsf/validator-ajv8` added support for precompiled validators as follows:
  - Added a new `compileSchemaValidators()` API function used to generate the precompiled validators for a schema to an output file
  - Updated the documentation for the `customizeValidator()` API function
  - Added a new `AJV8PrecompiledValidator` implementation of the `ValidatorType` interface
  - Refactored a large piece of the raw validation error processing from the `AJV8Validator` into a new `processRawValidationErrors()` function also used by the `AJV8PrecompiledValidator`
  - Added a new `usePrecompiledValidator()` API function that is similar to `customizeValidator()` but returning a precompiled validator-based `ValidatorType` interface implementation
  - Added some new types to the `types.ts` file in support of precompiled validators
  - Updated the main `index.ts` file to export the new types and API functions
  - Added 100% unit test coverage of the new feature
    - This included implementing a node function to precompile the `superSchema.json` file found in the `test/harness` directory
- Updated the `validation.md` documentation for the new precompiled validator functionality
- Added a new `validator-ajv8.md` documentation file to the `api-reference` directory and the `sidebar.js`
- Updated the `CHANGELOG.md` file accordingly
@heath-freenome heath-freenome mentioned this issue May 9, 2023
Merged
8 tasks
heath-freenome added a commit to heath-freenome/react-jsonschema-form that referenced this issue May 10, 2023
@heath-freenome
fix: Implement precompiled validator support in @rjsf/validator-ajv8
f80ed1b 
Fixes rjsf-team#3543 by implementing support for precompiled validators
- In `@rjsf/validator-ajv8` added support for precompiled validators as follows:
  - Added a new `compileSchemaValidators()` API function used to generate the precompiled validators for a schema to an output file
  - Updated the documentation for the `customizeValidator()` API function
  - Added a new `AJV8PrecompiledValidator` implementation of the `ValidatorType` interface
  - Refactored a large piece of the raw validation error processing from the `AJV8Validator` into a new `processRawValidationErrors()` function also used by the `AJV8PrecompiledValidator`
  - Added a new `usePrecompiledValidator()` API function that is similar to `customizeValidator()` but returning a precompiled validator-based `ValidatorType` interface implementation
  - Added some new types to the `types.ts` file in support of precompiled validators
  - Updated the main `index.ts` file to export the new types and API functions
  - Added 100% unit test coverage of the new feature
    - This included implementing a node function to precompile the `superSchema.json` file found in the `test/harness` directory
  - Added `ignorePatterns` to the `.eslintrc` file to ignore the precompiled schema files
- Updated the `validation.md` documentation for the new precompiled validator functionality
- Added a new `validator-ajv8.md` documentation file to the `api-reference` directory and the `sidebar.js`
- Updated the `CHANGELOG.md` file accordingly
heath-freenome added a commit to heath-freenome/react-jsonschema-form that referenced this issue May 10, 2023
@heath-freenome
fix: Implement precompiled validator support in @rjsf/validator-ajv8
eb7a423 
Fixes rjsf-team#3543 by implementing support for precompiled validators
- In `@rjsf/validator-ajv8` added support for precompiled validators as follows:
  - Added a new `compileSchemaValidators()` API function used to generate the precompiled validators for a schema to an output file
  - Updated the documentation for the `customizeValidator()` API function
  - Added a new `AJV8PrecompiledValidator` implementation of the `ValidatorType` interface
  - Refactored a large piece of the raw validation error processing from the `AJV8Validator` into a new `processRawValidationErrors()` function also used by the `AJV8PrecompiledValidator`
  - Added a new `usePrecompiledValidator()` API function that is similar to `customizeValidator()` but returning a precompiled validator-based `ValidatorType` interface implementation
  - Added some new types to the `types.ts` file in support of precompiled validators
  - Updated the main `index.ts` file to export the new types and API functions
  - Added 100% unit test coverage of the new feature
    - This included implementing a node function to precompile the `superSchema.json` file found in the `test/harness` directory
  - Added `ignorePatterns` to the `.eslintrc` file to ignore the precompiled schema files
- Updated the `validation.md` documentation for the new precompiled validator functionality
- Added a new `validator-ajv8.md` documentation file to the `api-reference` directory and the `sidebar.js`
- Updated the `CHANGELOG.md` file accordingly
heath-freenome added a commit to heath-freenome/react-jsonschema-form that referenced this issue May 10, 2023
@heath-freenome
fix: Implement precompiled validator support in @rjsf/validator-ajv8
d71d435 
Fixes rjsf-team#3543 by implementing support for precompiled validators
- In `@rjsf/validator-ajv8` added support for precompiled validators as follows:
  - Added a new `compileSchemaValidators()` API function used to generate the precompiled validators for a schema to an output file
  - Updated the documentation for the `customizeValidator()` API function
  - Added a new `AJV8PrecompiledValidator` implementation of the `ValidatorType` interface
  - Refactored a large piece of the raw validation error processing from the `AJV8Validator` into a new `processRawValidationErrors()` function also used by the `AJV8PrecompiledValidator`
  - Added a new `usePrecompiledValidator()` API function that is similar to `customizeValidator()` but returning a precompiled validator-based `ValidatorType` interface implementation
  - Added some new types to the `types.ts` file in support of precompiled validators
  - Updated the main `index.ts` file to export the new types and API functions
  - Added 100% unit test coverage of the new feature
    - This included implementing a node function to precompile the `superSchema.json` file found in the `test/harness` directory
  - Added `ignorePatterns` to the `.eslintrc` file to ignore the precompiled schema files
- Updated the `validation.md` documentation for the new precompiled validator functionality
- Added a new `validator-ajv8.md` documentation file to the `api-reference` directory and the `sidebar.js`
- Updated the `CHANGELOG.md` file accordingly
heath-freenome added a commit that referenced this issue May 11, 2023
@heath-freenome
fix: Implement precompiled validator support in @rjsf/validator-ajv8 (#…
91bcc94 
…3652)

* fix: Implement precompiled validator support in @rjsf/validator-ajv8
Fixes #3543 by implementing support for precompiled validators
- In `@rjsf/validator-ajv8` added support for precompiled validators as follows:
  - Added a new `compileSchemaValidators()` API function used to generate the precompiled validators for a schema to an output file
  - Updated the documentation for the `customizeValidator()` API function
  - Added a new `AJV8PrecompiledValidator` implementation of the `ValidatorType` interface
  - Refactored a large piece of the raw validation error processing from the `AJV8Validator` into a new `processRawValidationErrors()` function also used by the `AJV8PrecompiledValidator`
  - Added a new `usePrecompiledValidator()` API function that is similar to `customizeValidator()` but returning a precompiled validator-based `ValidatorType` interface implementation
  - Added some new types to the `types.ts` file in support of precompiled validators
  - Updated the main `index.ts` file to export the new types and API functions
  - Added 100% unit test coverage of the new feature
    - This included implementing a node function to precompile the `superSchema.json` file found in the `test/harness` directory
  - Added `ignorePatterns` to the `.eslintrc` file to ignore the precompiled schema files
- Updated the `validation.md` documentation for the new precompiled validator functionality
- Added a new `validator-ajv8.md` documentation file to the `api-reference` directory and the `sidebar.js`
- Updated the `CHANGELOG.md` file accordingly

* - Responded to self-review feedback

* - Replaced usage of `<` with `&lt;` to match the similar line later in the file

* - Fixed the peerDependencies in the `fluent-ui` package-lock.json and improved the `CHANGELOG.md` comments related to #3546

* - Responded to reviewer feedback
@fregante fregante mentioned this issue Dec 10, 2023
Closed
@fregante
Copy link
Contributor

To add some context: I think this only works if your extension has a static schema and can therefore be pre-compiled before submission to the store.

If the schema is user-provided, this won't fix the CSP issue.

I'm hopeful in the native support of non-eval validators:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@heath-freenome heath-freenome

Labels
ajv feature Is a feature request
Projects
None yet
Milestone
No milestone
4 participants
@fregante @fstn @heath-freenome @rwlodarczyk-xealth