form0-core 0.1.21 → 0.1.23
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SECURITY.md +13 -3
- package/package.json +1 -1
- package/src/utilities/dataset-descriptors.js +1 -1
package/SECURITY.md
CHANGED
|
@@ -1,5 +1,14 @@
|
|
|
1
1
|
# Security Features
|
|
2
2
|
|
|
3
|
+
> [!CAUTION] > `SAFE` and `CUSTOM` mode are validation aids, not security sandboxes. The
|
|
4
|
+
> evaluator compiles customer expressions with `new Function`; blocked-pattern
|
|
5
|
+
> checks can be bypassed through dynamic property access, and
|
|
6
|
+
> `maxExecutionTime` is not currently enforced. Do not execute untrusted
|
|
7
|
+
> schemas in a privileged server or browser context. See
|
|
8
|
+
> `analyses/SAFE_MODE_SECURITY_ANALYSIS.md` for the accepted critical finding
|
|
9
|
+
> and `analyses/UNTRUSTED_JAVASCRIPT_EXECUTION_ARCHITECTURE.md` for the selected
|
|
10
|
+
> isolation architecture that preserves vanilla JavaScript and imperative event scripts.
|
|
11
|
+
|
|
3
12
|
form0-core provides configurable security options for expression evaluation to balance flexibility and safety.
|
|
4
13
|
|
|
5
14
|
## Security Modes
|
|
@@ -23,11 +32,12 @@ const engine = createFormEngine({
|
|
|
23
32
|
});
|
|
24
33
|
```
|
|
25
34
|
|
|
26
|
-
### SAFE
|
|
35
|
+
### SAFE (validation only; not a trust boundary)
|
|
27
36
|
|
|
28
37
|
- **Restricted context** - Only whitelisted globals available
|
|
29
38
|
- **Pattern blocking** - Dangerous patterns are blocked
|
|
30
|
-
- **Use case**:
|
|
39
|
+
- **Use case**: Diagnostics for trusted authors. It is not suitable for
|
|
40
|
+
adversarial or otherwise untrusted expressions.
|
|
31
41
|
|
|
32
42
|
```javascript
|
|
33
43
|
import { createFormEngine, SECURITY_MODES, SAFE_SECURITY_CONFIG } from 'form0-core';
|
|
@@ -113,7 +123,7 @@ const engine = createFormEngine({ schema, initialValues });
|
|
|
113
123
|
To add security, simply include the security parameter:
|
|
114
124
|
|
|
115
125
|
```javascript
|
|
116
|
-
// Add safe mode
|
|
126
|
+
// Add validation-oriented safe mode. This is not a sandbox.
|
|
117
127
|
const engine = createFormEngine({
|
|
118
128
|
schema,
|
|
119
129
|
initialValues,
|
package/package.json
CHANGED