Skip to content

Support configuring AJV allErrors to follow their recommended security practices #954

Closed
@mdmower-csnw

Description

@mdmower-csnw

Is your feature request related to a problem? Please describe.

In AJV's security considerations documentation, they write "Do NOT use allErrors in production":

Some keywords in JSON Schemas can lead to very slow validation for certain data. These keywords include (but may be not limited to):

  • pattern and format for large strings - in some cases using maxLength can help mitigate it, but certain regular expressions can lead to exponential validation time even with relatively short strings (see ReDoS attack).
  • patternProperties for large property names - use propertyNames to mitigate, but some regular expressions can have exponential evaluation time as well.
  • uniqueItems for large non-scalar arrays - use maxItems to mitigate

Do NOT use allErrors in production

The suggestions above to prevent slow validation would only work if you do NOT use allErrors: true in production code (using it would continue validation after validation errors).

Unfortunately, express-openapi-validator overrides whatever the user attempts to set for allErrors:

const ajv = new AjvDraft4({
...ajvOptions,
allErrors: true,
formats: formats,
});

Note: allErrors is also set to true in OpenAPISchemaValidator, but that is less concerning since it is just used for OpenAPI schema validation and not end user requests.

Describe the solution you'd like
It should be possible for developers to set allErrors: false and express-openapi-validator will respect it.

Describe alternatives you've considered
(none)

Additional context
This could help mitigate ReDOS attacks, at least to a small extent.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions