-
-
Notifications
You must be signed in to change notification settings - Fork 3.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use static config validation with built in widgets to pass CSP without unsafe-eval #6106
Open
taras
wants to merge
21
commits into
decaporg:main
Choose a base branch
from
taras:dynamic-or-static-ajv-validation
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+19,995
−2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
taras
force-pushed
the
dynamic-or-static-ajv-validation
branch
from
January 7, 2022 21:35
61c31e0
to
b06567d
Compare
@erezrokah this PR is going to be blocked by the fact that |
erezrokah
added
the
type: feature
code contributing to the implementation of a feature and/or user facing functionality
label
Jan 10, 2022
taras
changed the title
Introducing static config validation to overcome allow running where unsafe-eval is disallowed
Use static config validation with built in schema validation to pass CSP without unsafe-eval
Jan 10, 2022
taras
changed the title
Use static config validation with built in schema validation to pass CSP without unsafe-eval
Use static config validation with built in widgets to pass CSP without unsafe-eval
Jan 10, 2022
@taras are you still interested in moving this forward? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
type: feature
code contributing to the implementation of a feature and/or user facing functionality
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #2138
Summary
Follow up to our proposal in #2138 (comment) to introduce static config validation that allows Netlify CMS to run in environments where Content Security Policy (CSP) prevents runtime code eval with
unsafe-eval
rule.This PR introduces a number of changes to make this work,
ajv
package to8.8.2
&ajv-keywords
to5.0.0
innetlify-cms-core
workspaceajv-cli
as a dependency tonetlify-cms-core
packages/netlify-cms-core/config.schema.json
write-validate-schema
to package.json ofnetlify-cms-core
which usesajv
CLI command to generatepackage/netlify-cms-core/src/constants/staticValidateConfig.js
package/netlify-cms-core/validation-rules/{instanceof.js,uniqueItemProprties.js}
created with support forajv@8
which is not supported inajv-keywords
validateConfig
function modified to check if there are any custom widgets with custom schema. When no custom schemas are present, NetlifyCMS config validation defaults to usestaticValidateConfig.js
instead of dynamic validationajv-errors
becauseerrorMessage
keyword is not used in the schemaTest plan
Refactored
configSchema.spec.js
to run tests for dynamic and static validation.TODO
tsc --noEmit
.Checklist
Please add a
x
inside each checkbox:yarn format
.yarn test
.A picture of a cute animal (not mandatory but encouraged)
Picture of my husky at the Pacific Ocean