ajv - npm Package Compare versions

Comparing version 6.12.6 to 6.14.0

lib/ajv.d.ts

@@ -206,4 +206,9 @@ declare var ajv: {
     serialize?: ((schema: object | boolean) => any) | false;
+    regExp?: (pattern: string) => RegExpLike;
   }
 
+  interface RegExpLike {
+    test: (s: string) => boolean;
+  }
+
   type FormatValidator = string | RegExp | ((data: string) => boolean | PromiseLike<any>);
@@ -210,0 +215,0 @@ type NumberFormatValidator = ((data: number) => boolean | PromiseLike<any>);

lib/compile/index.js

@@ -45,2 +45,7 @@ 'use strict';
 
+  function patternCode(i, patterns) {
+    var regExpCode = opts.regExp ? 'regExp' : 'new RegExp';
+    return 'var pattern' + i + ' = ' + regExpCode + '(' + util.toQuotedString(patterns[i]) + ');';
+  }
+
   root = root || { schema: schema, refVal: refVal, refs: refs };
@@ -132,2 +137,3 @@
         'ValidationError',
+        'regExp',
         sourceCode
@@ -146,3 +152,4 @@ );
         ucs2length,
-        ValidationError
+        ValidationError,
+        opts.regExp
       );
@@ -364,7 +371,2 @@
 
-function patternCode(i, patterns) {
-  return 'var pattern' + i + ' = new RegExp(' + util.toQuotedString(patterns[i]) + ');';
-}
-
-
 function defaultCode(i) {
@@ -371,0 +373,0 @@ return 'var default' + i + ' = defaults[' + i + '];';

lib/dotjs/pattern.js

@@ -11,2 +11,3 @@ 'use strict';
   var $data = 'data' + ($dataLvl || '');
+  var $valid = 'valid' + $lvl;
   var $isData = it.opts.$data && $schema && $schema.$data,
@@ -20,8 +21,17 @@ $schemaValue;
   }
-  var $regexp = $isData ? '(new RegExp(' + $schemaValue + '))' : it.usePattern($schema);
-  out += 'if ( ';
+  var $regExpCode = it.opts.regExp ? 'regExp' : 'new RegExp';
   if ($isData) {
-    out += ' (' + ($schemaValue) + ' !== undefined && typeof ' + ($schemaValue) + ' != \'string\') || ';
+    out += ' var ' + ($valid) + ' = true; try { ' + ($valid) + ' = ' + ($regExpCode) + '(' + ($schemaValue) + ').test(' + ($data) + '); } catch(e) { ' + ($valid) + ' = false; } if ( ';
+    if ($isData) {
+      out += ' (' + ($schemaValue) + ' !== undefined && typeof ' + ($schemaValue) + ' != \'string\') || ';
+    }
+    out += ' !' + ($valid) + ') {';
+  } else {
+    var $regexp = it.usePattern($schema);
+    out += ' if ( ';
+    if ($isData) {
+      out += ' (' + ($schemaValue) + ' !== undefined && typeof ' + ($schemaValue) + ' != \'string\') || ';
+    }
+    out += ' !' + ($regexp) + '.test(' + ($data) + ') ) {';
   }
-  out += ' !' + ($regexp) + '.test(' + ($data) + ') ) {   ';
   var $$outStack = $$outStack || [];
@@ -28,0 +38,0 @@ $$outStack.push(out);

package.json

 {
   "name": "ajv",
-  "version": "6.12.6",
+  "version": "6.14.0",
   "description": "Another JSON Schema Validator",
@@ -93,2 +93,3 @@ "main": "lib/ajv.js",
     "pre-commit": "^1.1.1",
+    "re2": "^1.21.4",
     "require-globify": "^1.3.0",
@@ -95,0 +96,0 @@ "typescript": "^3.9.5",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 2 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

938185

0.97%

Lines of code

13232

0.16%

Number of lines in readme file

1506

0.53%

Worsened metrics

Dev dependency count

27

3.85%

Number of low supply chain risk alerts

64

3.23%

No dependency changes