Adds json schema parsing check during body validation

[artem-zakharchenko]

Performs given JSON Schema parsing during body validation to prevent processing of invalid or malformed JSON Schema. Note that this performs no actual validation either a JSON Schema is a valid JSON Schema.

GitHub

• Fixes validateBody() throws in case it is provided with no schema #203
• Relates to the issue's origin: " in JSON values are not escaped correctly drafter#719
• Discovered originally in https://github.com/apiaryio/apiary/commit/6b6c1723153bb0e0e358a1e0cb94fd9dc1b9b277

[artem-zakharchenko]

@kylef, could you please review it once more?

• Adjusted the developer-friendly message to suggest to check the given JSON's validity (not the JSON Schema validity)
• Error message now includes only the parsing error (error.message) instead of the entire stack

[honzajavorek]

I think at other places in Gavel we use json-parse-helpfulerror to provide even more helpful error messages than what JSON.parse() provides

[kylef]

I was looking for how the message body was done, didn't find it with JSON.parse.

src/mixins/validatable-http-message.coffee:jph = require 'json-parse-helpfulerror'
src/mixins/validatable-http-message.coffee:        jph.parse @body
src/mixins/validatable-http-message.coffee:        jph.parse @body
src/mixins/validatable-http-message.coffee:          parsed = jph.parse @expected.bodySchema
src/mixins/validatable-http-message.coffee:          jph.parse @expected.body
src/mixins/validatable-http-message.coffee:          jph.parse @expected.body

[artem-zakharchenko]

While looking over the changes yesterday I've spotted that we already have a part of the body validation that attempts to parse a JSON Schema:

gavel.js/lib/units/validateBody.js

Lines 102 to 109 in bba8206

	try {
	jph.parse(bodySchema);
	return [null, jsonSchemaType];
	} catch (exception) {
	const error = `Can't validate: expected body JSON Schema is not a parseable JSON:\n${exception.message}`;
	return [error, null];
	}

Which means that mentioned issue scenario somehow doesn't trigger this logic. I would need to investigate. Hopefully, we don't need any new functions/checks, just need to fix the old ones.

[artem-zakharchenko]

So, it looks like with the current founding we must treat malformed JSON Schemas like an exception. Shall we change this to an exception then?

const error = `Can't validate: expected body JSON Schema is not a parseable JSON:\n${exception.message}`; 
  
return [error, null]; 

At the moment it's being tolerated as a validation error, not stopping the process, and ending up in the public results.

[artem-zakharchenko]

I confirm that changing that soft handling to throwing an exception produces the same behavior:

• Stops Gavel validation to prevent operating on malformed data
• Propagates user-friendly error + JSON parsing error from jph

[honzajavorek]

I think exception is all right. If Gavel is given schema, the user's intention is to validate according to it. If Gavel cannot parse it, then it shouldn't be silent or just warning. There's no way for Gavel to continue in that case, otherwise it could lead to false positives in validation.

[ApiaryBot]

🎉 This PR is included in version 6.1.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀