sast-json-schema

library0.4.1jsnpmunverified

A meta-schema for performing static application security testing (SAST) on JSON Schemas. Current version 0.4.1 (released June 2025) requires Node.js >=24. It enforces security best practices including strict integer/number ranges, defined string maxLength and allowed values, safe array and object property limits, secure RegExp patterns, and safe $id/$ref resolution. Released under MIT license with SLSA 3 provenance and OpenSSF Scorecard. Differentiated by providing a comprehensive, security-focused meta-schema that checks JSON Schemas for common vulnerabilities, aligning with OWASP ASVS and NIST guidelines.

security

npm install sast-json-schema

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SAST-JSON-SCHEMA

sast-json-schema

securityjavascriptv0.4.1

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default (JSON)

✓ import sastSchema from 'sast-json-schema' with { type: 'json' }

✗ import sastSchema from 'sast-json-schema'

Requires import attribute 'with { type: "json" }' to load the JSON file. Without it, Node.js may error on module resolution.

default (require)

✓ const sastSchema = require('sast-json-schema')

✗ const sastSchema = require('sast-json-schema/json')

CommonJS require works directly; mispathing the file leads to undefined.

per-draft import (ESM)

✓ import schema2020 from 'sast-json-schema/2020-12' with { type: 'json' }

✗ import schema2020 from 'sast-json-schema/2020-12'

Use subpath exports for specific JSON Schema drafts. Available: /2020-12, /2019-09, /draft-07, /draft-06, /draft-04.

Validates a JSON Schema against the SAST meta-schema to detect security vulnerabilities. Uses Ajv 2020 edition.

import Ajv from "ajv/dist/2020.js"; import sastSchema from "sast-json-schema" with { type: "json" }; import schema from "./example.json" with { type: "json" }; // Validate your schema with strictTypes:true const userAjv = new Ajv({ strictTypes: true }); if (!userAjv.validateSchema(schema)) { console.error("Schema validation errors:", userAjv.errors); } // SAST check using the meta-schema (needs strictTypes:false because subschemas may be false) const sastAjv = new Ajv({ strictTypes: false }); const isSchemaSecure = sastAjv.compile(sastSchema); if (!isSchemaSecure(schema)) { console.error("Security issues:", isSchemaSecure.errors); }

Debug

Known issues

gotchaRequires Node.js version >=24. Older versions are not supported and will fail to install/run.

fix

Upgrade Node.js to version 24 or later.

affects: <0.4.0

gotchaThe meta-schema uses strictTypes:false in Ajv because subschemas may be boolean (false). Using strictTypes:true will cause validation errors.

fix

Create a separate Ajv instance with strictTypes: false for SAST validation.

affects: >=0.0.0

gotchaImport attribute 'with { type: "json" }' is required in ESM. Omitting it causes Node.js to throw ERR_IMPORT_ASSERTION_TYPE_MISSING.

fix

Append ' with { type: "json" }' to the import statement.

affects: >=0.0.0

deprecatedNo deprecation warnings currently. Version 0.4.1 is the latest stable release.

affects: >=0.4.1

Errors

Common errors & fixes

TypeError: ajv.validateSchema is not a function

Using Ajv version 7 or earlier which does not have validateSchema method.

fix

Install Ajv version 8 or later: npm install ajv@latest

Error [ERR_IMPORT_ASSERTION_TYPE_MISSING]: Module "sast-json-schema" needs an import attribute of type "json"

Missing or incorrect import attribute for JSON module in ESM.

fix

Use: import sastSchema from 'sast-json-schema' with { type: 'json' }

Cannot find module 'sast-json-schema/draft-04'

Attempting to import a draft version that does not exist in the package exports.

fix

Check available drafts: /2020-12, /2019-09, /draft-07, /draft-06, /draft-04 are all valid.

Upgrade

Version history

0.4.1latest on npm

Audit

Dependencies

ajvrequiredUsed to compile and validate schemas against the meta-schema. Must be installed separately.

Agent activity

21 hits · last 30 days

node

Resources

githubhttps://github.com/willfarrell/sast-json-schema ↗

packagesast-json-schema ↗

homepagehttps://github.com/willfarrell/sast-json-schema/ ↗