epcis plugin V1 #22
epcis plugin V1 #22
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| // Validate against GS1 schema | ||
| const isValid = this.validateSchema(document); |
Check failure
Code scanning / CodeQL
Resources exhaustion from deep object traversal High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
In general, the fix is to avoid using allErrors: true when validating user-controlled input in production. Instead, only enable allErrors conditionally (e.g., based on an environment variable or a debug flag) so production validates only until the first error and does not allocate unbounded error arrays.
The best fix here is to change the Ajv instantiation in EpcisValidationService to make allErrors conditional on an environment variable (for example EPCIS_DEBUG), mirroring the recommended pattern from the background section. This keeps current functionality for debugging (developers can still see all validation errors when they explicitly enable debug mode), but prevents the denial-of-service risk in normal operation. No other logic needs to change, because Ajv’s errors array is still populated when validation fails; it will just contain fewer entries in non-debug mode.
Concretely, in packages/plugin-epcis/src/services/EPCISValidationService.ts, update the constructor where new Ajv is called: replace allErrors: true with allErrors: process.env["EPCIS_DEBUG"] === "true". This is the only code change needed. No changes are required in packages/plugin-epcis/src/index.ts, and no new imports or helper methods are necessary.
| @@ -9,7 +9,7 @@ | ||
|
|
||
| constructor() { | ||
| this.ajv = new Ajv({ | ||
| allErrors: true, | ||
| allErrors: process.env["EPCIS_DEBUG"] === "true", | ||
| strict: false, | ||
| validateFormats: true, | ||
| }); |
Lexpeartha
left a comment
Lexpeartha
left a comment
There was a problem hiding this comment.
Please also document new .env variable and add it to env.d.ts
|
MilanKomsa
dismissed
Lexpeartha’s stale review
there is no .env variable used in code
No description provided.