Description
Is your feature request related to a problem? Please describe.
In AJV's security considerations documentation, they write "Do NOT use allErrors in production":
Some keywords in JSON Schemas can lead to very slow validation for certain data. These keywords include (but may be not limited to):
pattern
andformat
for large strings - in some cases usingmaxLength
can help mitigate it, but certain regular expressions can lead to exponential validation time even with relatively short strings (see ReDoS attack).patternProperties
for large property names - usepropertyNames
to mitigate, but some regular expressions can have exponential evaluation time as well.uniqueItems
for large non-scalar arrays - usemaxItems
to mitigateDo NOT use allErrors in production
The suggestions above to prevent slow validation would only work if you do NOT use
allErrors: true
in production code (using it would continue validation after validation errors).
Unfortunately, express-openapi-validator overrides whatever the user attempts to set for allErrors
:
express-openapi-validator/src/framework/ajv/index.ts
Lines 33 to 37 in f20b1c9
Note: allErrors
is also set to true
in OpenAPISchemaValidator
, but that is less concerning since it is just used for OpenAPI schema validation and not end user requests.
Describe the solution you'd like
It should be possible for developers to set allErrors: false
and express-openapi-validator will respect it.
Describe alternatives you've considered
(none)
Additional context
This could help mitigate ReDOS attacks, at least to a small extent.