RocksonZeta / koa-validate

validate koa request params and format request params
https://github.com/RocksonZeta/koa-validate
MIT License
284 stars 32 forks source link

Fix security issues #37

Closed JonFranchi closed 1 year ago

JonFranchi commented 1 year ago

There are a couple of breaking changes in here to point out which became necessary.

  1. the entire "json path" functionality was actually xpath -- it is now jsonpath. The original author of json-path wrote an article comparing xpath to json path and extolling the virtues of the latter, but the underlying library was using xpath and all unit tests that said jsonpath actually had xpath in the inputs. This was confusing as hell to unwind as I could not figure out why this was the case.
    The replacement library for json-path, jsonpath-plus even references the old jsonpath library, but it no longer supports xpath and I couldn't find a good way to support xpath for json traversal nor really a good reason to.
  2. The latest version of validate (which became validator.js) was 8 major versions ahead, but the only breaking change was on the usage if isNull. It was deprecated and then dropped, because it only checked strings and only handled emptiness. It was replaced with isEmpty. Since original intent was for the same isEmpty usage (the unit tests in this library only tested two strings against that function, one empty + one not), I preferred to change the function to isEmpty rather than making a functional version of isNull.

On the 1st issue, we are probably fine. I don't think we ever used this in our code, but its a pretty powerful tool if we want to. On the 2nd issue, I'm guessing we need to double check for usage here.