Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use static config validation with built in widgets to pass CSP without unsafe-eval #6106

Open
wants to merge 20 commits into
base: main
Choose a base branch
from

Conversation

taras
Copy link

@taras taras commented Jan 7, 2022

Closes #2138

Summary

Follow up to our proposal in #2138 (comment) to introduce static config validation that allows Netlify CMS to run in environments where Content Security Policy (CSP) prevents runtime code eval with unsafe-eval rule.

This PR introduces a number of changes to make this work,

  1. Upgraded ajv package to 8.8.2 & ajv-keywords to 5.0.0 in netlify-cms-core workspace
  2. Added ajv-cli as a dependency to netlify-cms-core
  3. Validation schema necessary to validate all of the built in widgets was extracted to packages/netlify-cms-core/config.schema.json
  4. Added write-validate-schema to package.json of netlify-cms-core which uses ajv CLI command to generate package/netlify-cms-core/src/constants/staticValidateConfig.js
  5. package/netlify-cms-core/validation-rules/{instanceof.js,uniqueItemProprties.js} created with support for ajv@8 which is not supported in ajv-keywords
  6. validateConfig function modified to check if there are any custom widgets with custom schema. When no custom schemas are present, NetlifyCMS config validation defaults to use staticValidateConfig.js instead of dynamic validation
  7. Removed ajv-errors because errorMessage keyword is not used in the schema

Test plan

Refactored configSchema.spec.js to run tests for dynamic and static validation.

TODO

  • TypeScript needs to be upgraded because AJV 8 uses TypeScript 4 which includes definitions that can not pass tsc --noEmit.

Checklist

Please add a x inside each checkbox:

  • I have read the contribution guidelines.
  • Code is formatted via running yarn format.
  • Tests are passing via running yarn test.
  • The status checks are successful (continuous integration). Those can be seen below.

A picture of a cute animal (not mandatory but encouraged)

Picture of my husky at the Pacific Ocean

6AF1FF80-CB8D-49DA-BA33-73D27642CC1D_1_105_c

@taras taras requested a review from a team January 7, 2022 21:25
@taras taras force-pushed the dynamic-or-static-ajv-validation branch from 61c31e0 to b06567d Compare January 7, 2022 21:35
@taras
Copy link
Author

taras commented Jan 7, 2022

@erezrokah this PR is going to be blocked by the fact that ajv@8 uses TypeScript 4+ and has syntax in type definition files that is not supported by TypeScript 3 used by this project. As a result, tests pass but type check fails. I'm not sure what to do with this because it's out of scope of this particular issue.

@erezrokah erezrokah added the type: feature code contributing to the implementation of a feature and/or user facing functionality label Jan 10, 2022
@taras taras changed the title Introducing static config validation to overcome allow running where unsafe-eval is disallowed Use static config validation with built in schema validation to pass CSP without unsafe-eval Jan 10, 2022
@taras taras changed the title Use static config validation with built in schema validation to pass CSP without unsafe-eval Use static config validation with built in widgets to pass CSP without unsafe-eval Jan 10, 2022
@taras taras mentioned this pull request Jan 10, 2022
4 tasks
@erezrokah erezrokah assigned ehmicky and erezrokah and unassigned ehmicky Jan 11, 2022
@martinjagodic
Copy link
Member

@taras are you still interested in moving this forward?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: feature code contributing to the implementation of a feature and/or user facing functionality
Projects
None yet
5 participants