≡

JSON Schema for AJAX request

JSON Schema for AJAX request

WernfriedWernfried Posts: 61Questions: 14Answers: 0

Hi Allan

I have a question regarding security. One important rule says "Treat all user-supplied data as untrusted." A common way to ensure security is to validate user-supplied data against a JSON Schema. I have not found any JSON Schema for datatable ajax data. I only found Server-side processing: Sent parameters

I would like to contribute to this part. I already created a working (at least for me) JSON Schema, including also parameters for ColumnControl and SearchBuilder extension. It is also extendable to support extra parameters

Of course, I could copy/paste the schema here as text, however I think it would make more sense to create a PR in your github repository.

What do you think? What would be an appropriate place for it?

Best Regards
Wernfried

Replies

  • allanallan Posts: 66,175Questions: 1Answers: 11,037 Site admin

    Hi,

    The data sent to the server, by default, is HTTP parameters, rather than JSON in the request body (although that can easily be done using ajax.submitAs), so a JSON schema isn't something that would be used in the default case.

    However, as noted, JSON can be sent, and a JSON schema can be both useful for validation and for documentation.

    What would be an appropriate place for it?

    That's a good question - probably in the manual. It could possibly go in the server-side library packages, but I think the manual would be an appropriate place for it. Another option would be a new distribution package - JSON schemas aren't something I've worked with for a number of years now, so I'm not familiar with the current distribution standards.

    The manual being the current target, if you just paste what you have in here, I can get it in and onto the site.

    Allan

  • WernfriedWernfried Posts: 61Questions: 14Answers: 0

    Hi Allan

    I created the JSON Schema, due to size you will find it at https://live.datatables.net/fovisime/1/edit?js

    Some notes:

    • I don't know whether I covered all features and options of DataTables. Let me know if someone get unexpected validation errors, then I will modify the schema accordingly
    • Keyword additionalProperties was introduced in JSON Schema Draft 2019-09. If you use an older version, then this property may be silently ignored which makes the schema less strict.
    • Keyword $defs was also introduced in Draft 2019-09, before it was definitions. However, most validators supports both keywords - but you never know.
    • The JSON declares schema version "$schema": "https://json-schema.org/draft/2019-09/schema". Not every validator evaluates this.
    • Sub-Schema for stateRestore.ajax you get with
      $ref: 'datatables.net#/$defs/stateRestore'

    Example usage:

    import { constants as httpConstants } from 'http2';
    import Ajv from 'ajv/dist/2019.js';
    const ajv = new Ajv();
    
    const schema = JSON.parse(await readFile('./schema/datatable.json', 'utf8'));
    const schemaValidator = ajv.compile(schema);
    
    router.post('/index', (req, res, next) => {
      const validate = schemaValidator;
      if (!validate(req.body))
          return res.sendStatus(httpConstants.HTTP_STATUS_UNPROCESSABLE_ENTITY);
    
      ... else process the request
    });
    

    Consult the documentation of your validator for more details.

    If you extend your data with ajax.data then you must extend also the JSON schema.

    Assume you extend your payload like this:

    new DataTable('#myTable', {
        ajax: {
            url: 'data.json',
            data: {
                user_id: 451
            }
        }
    });
    

    Then you need to reference the schema and extend it like this:

    Allow extra parameter user_id:

    {
      "type": "object",
      "allOf": [
        { "$ref": "datatables.net#/$defs/core" },
        "properties": { 
          "user_id": { "type": "integer" } 
        }
      ],
      "unevaluatedProperties": false
    }
    

    Require extra parameter user_id:

    {
      "type": "object",
      "allOf": [
        { "$ref": "datatables.net#/$defs/core" },
        "properties": { 
          "user_id": { "type": "integer" }", 
        },
        required": [ "age" ] 
      ],
      "unevaluatedProperties": false
    }
    

    Allow arbitrary extra parameter:

    {
      "type": "object",
      "allOf": [
        { "$ref": "datatables.net#/$defs/core" },
      ],
      "unevaluatedProperties": true
    }
    

    Kind Regards and enjoy
    Wernfried

  • allanallan Posts: 66,175Questions: 1Answers: 11,037 Site admin

    Hi Wernfried,

    Absolutely brilliant - thank you! I'll do some research to see if there is a way that JSON schemas can be published so they can be used for development.

    Allan

Sign In or Register to comment.