🛠️ About This Fork

This is a fork of ajv (based on v8.20.0) created to improve Content Security Policy (CSP) compliance for secure web environments.

🚨 Why Fork?

Upstream Ajv compiles every JSON Schema (and JSON Type Definition parser/serializer) into JavaScript source code and turns it into a function using new Function(). This is blocked under CSP unless unsafe-eval is allowed in script-src, which presents security concerns for browser-based applications that enforce strict CSP rules. Without unsafe-eval, schema compilation fails with an error like:

EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script

✅ What Was Changed

• 🔁 Replaced new Function() with the SVAL JavaScript interpreter (see lib/interprete.ts), so the generated validation code is interpreted instead of evaluated. This applies to:
  • schema compilation (lib/compile/index.ts)
  • JTD parser generation (lib/compile/jtd/parse.ts)
  • JTD serializer generation (lib/compile/jtd/serialize.ts)
• 🧪 Adjusted unit tests to work with the interpreted functions.
• 🔒 Ensures JSON Schema validation can run in environments with strict CSP (e.g. browsers without unsafe-eval).
• 📦 Adds the sval runtime dependency.

Ajv JSON schema validator

JSON validator for Node.js and browser. Upstream Ajv is the fastest JSON validator, but this fork trades some of that speed for CSP compatibility (see Performance).

Supports JSON Schema draft-04/06/07/2019-09/2020-12 (draft-04 support requires ajv-draft-04 package) and JSON Type Definition RFC8927.

Ajv sponsors

Contributing

More than 100 people contributed to Ajv, and we would love to have you join the development. We welcome implementing new features that will benefit many users and ideas to improve our documentation.

Please review Contributing guidelines and Code components.

Documentation

All documentation is available on the Ajv website.

Some useful site links:

• Getting started
• JSON Schema vs JSON Type Definition
• API reference
• Strict mode
• Standalone validation code
• Security considerations
• Command line interface
• Frequently Asked Questions

Please sponsor Ajv development

Since I asked to support Ajv development 40 people and 6 organizations contributed via GitHub and OpenCollective - this support helped receiving the MOSS grant!

Your continuing support is very important - the funds will be used to develop and maintain Ajv once the next major version is released.

Please sponsor Ajv via:

• GitHub sponsors page (GitHub will match it)
• Ajv Open Collective

Thank you.

Open Collective sponsors

Performance

Note for this fork: the generated validation code is executed by the SVAL interpreter instead of new Function(), so it is not JIT-compiled by V8. Validation is slower than in upstream Ajv, and the benchmarks below describe upstream Ajv only. If your environment allows unsafe-eval and you need maximum performance, use upstream ajv.

Upstream Ajv generates code to turn JSON Schemas into super-fast validation functions that are efficient for v8 optimization.

Upstream Ajv is the fastest and the most standard compliant validator according to these benchmarks:

• json-schema-benchmark - 50% faster than the second place
• jsck benchmark - 20-190% faster
• z-schema benchmark
• themis benchmark

Performance of different validators by json-schema-benchmark:

Features

• Ajv implements JSON Schema draft-06/07/2019-09/2020-12 standards (draft-04 is supported in v6):
  • all validation keywords (see JSON Schema validation keywords)
  • OpenAPI extensions:
    • NEW: keyword discriminator.
    • keyword nullable.
  • full support of remote references (remote schemas have to be added with addSchema or compiled to be available)
  • support of recursive references between schemas
  • correct string lengths for strings with unicode pairs
  • JSON Schema formats (with ajv-formats plugin).
  • validates schemas against meta-schema
• NEW: supports JSON Type Definition:
  • all keywords (see JSON Type Definition schema forms)
  • meta-schema for JTD schemas
  • "union" keyword and user-defined keywords (can be used inside "metadata" member of the schema)
• supports browsers and Node.js 18.x - current
• asynchronous loading of referenced schemas during compilation
• "All errors" validation mode with option allErrors
• error messages with parameters describing error reasons to allow error message generation
• i18n error messages support with ajv-i18n package
• removing-additional-properties
• assigning defaults to missing properties and items
• coercing data to the types specified in type keywords
• user-defined keywords
• additional extension keywords with ajv-keywords package
• $data reference to use values from the validated data as values for the schema keywords
• asynchronous validation of user-defined formats and keywords

Install

To install version 8:

npm install ajv-csp-compatibility

Getting started

In JavaScript:

// or ESM/TypeScript import
import Ajv from "ajv-csp-compatibility"
// Node.js require:
const Ajv = require("ajv-csp-compatibility")

const ajv = new Ajv() // options can be passed, e.g. {allErrors: true}

const schema = {
  type: "object",
  properties: {
    foo: {type: "integer"},
    bar: {type: "string"},
  },
  required: ["foo"],
  additionalProperties: false,
}

const data = {
  foo: 1,
  bar: "abc",
}

const validate = ajv.compile(schema)
const valid = validate(data)
if (!valid) console.log(validate.errors)

Learn how to use Ajv and see more examples in the Guide: getting started

Changes history

See https://github.com/ajv-validator/ajv/releases

Please note: Changes in version 8.0.0

Version 7.0.0

Version 6.0.0.

Code of conduct

Please review and follow the Code of conduct.

Please report any unacceptable behaviour to [email protected] - it will be reviewed by the project team.

Security contact

To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure. Please do NOT report security vulnerabilities via GitHub issues.

Open-source software support

Ajv is a part of Tidelift subscription - it provides a centralised support to open-source software users, in addition to the support provided by software maintainers.

License

MIT