README
@exodus/schemasafe
A code-generating JSON Schema validator that attempts to be reasonably secure.
Supports draft-04/06/07/2019-09/2020-12 and the
discriminator
OpenAPI keyword.
Features
- Converts schemas to self-contained JavaScript files, can be used in the build process.
Integrates nicely with bundlers, so one won't need to generate code in runtime, and that works with CSP. - Optional
requireValidation: true
mode enforces full validation of the input object.
Usingmode: "strong"
is recommended, — it combines that option with additional schema safety checks. - Does not fail open on unknown or unprocessed keywords — instead throws at build time if schema was not fully understood. That is implemented by tracking processed keywords and ensuring that none remain uncovered.
- Does not fail open on schema problems — instead throws at build time.
E.g. it will detect mistakes like{type: "array", "maxLength": 2}
. - Less than 2000 lines of code, non-minified.
- Uses secure code generation approach to prevent data from schema from leaking into the generated code without being JSON-wrapped.
- 0 dependencies
- Very fast
- Supports JSON Schema draft-04/06/07/2019-09 and a strict subset of the
discriminator
OpenAPI keyword. - Can assign defaults and/or remove additional properties when schema allows to do that safely. Throws at build time if those options are used with schemas that don't allow to do that safely.
Installation
npm install --save @exodus/schemasafe
Usage
Simply pass a schema to compile it:
const { validator } = require('@exodus/schemasafe')
const validate = validator({
type: 'object',
required: ['hello'],
properties: {
hello: {
type: 'string'
}
}
})
console.log('should be valid', validate({ hello: 'world' }))
console.log('should not be valid', validate({}))
Or use the parser API (running in strong mode by default):
const { parser } = require('.')
const parse = parser({
$schema: 'https://json-schema.org/draft/2019-09/schema',
type: 'object',
required: ['hello'],
properties: {
hello: {
pattern: '^[a-z]+