Precompile the HAR schema and drop ajv, for CSP reasons?

[s100]

We use @readme/httpsnippet in the browser, just like you do (for almost exactly the same purpose as ReadMe does, in fact). However, our Content Security Policy specifies a script-src of script-src: 'self', and intentionally excludes 'unsafe-eval'. Because @readme/httpsnippet uses ajv internally to validate HARs, and ajv dynamically creates functions to perform validation, we find that loading @readme/httpsnippet in the browser causes a crash at this line of code:

httpsnippet/src/helpers/har-validator.ts

Line 24 in f103211

ajv.addSchema(schema);

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

    at new Function (<anonymous>)
    at Ajv.localCompile (index.js:120:1)
    at Ajv.resolve (resolve.js:54:1)
    at Object.resolveRef (index.js:189:1)
    at Object.generate_ref [as code] (ref.js:21:1)
    at Object.generate_validate [as validate] (validate.js:277:1)
    at Object.generate_properties [as code] (properties.js:201:1)
    at generate_validate (validate.js:374:1)
    at localCompile (index.js:88:1)
    at Ajv.compile (index.js:55:1)

Use of new Function is an intentional design decision/limitation of ajv, made for performance reasons. ajv's maintainers suggest a workaround of pre-compiling your schema. This does seem like a workable approach because @readme/httpsnippet doesn't need to dynamically validate against multiple schemas, just the fixed HAR schema imported from har-schema.

(This issue was previously raised against httpsnippet but was never addressed before that package was deprecated.)

Thanks in advance for any work you can do on this.

[erunion]

I've actually been thinking lately about removing the ajv dependency completely from this package as all of the HARs that we supply it within ReadMe are already validated. Would removing ajv, and all HAR validation, from within here cause issues in your implementation?

[s100]

That would cause no issues for us. However, I can't speak for all other consumers of this package.

[erunion]

@s100 As of 5.0.0 we no longer ship AJV or do any HAR validation. This should resolve your issues!

https://github.com/readmeio/httpsnippet/releases/tag/5.0.0

[s100]

Wonderful. Thank you very much!