{"id":49279,"library":"sast-json-schema","title":"sast-json-schema","description":"A meta-schema for performing static application security testing (SAST) on JSON Schemas. Current version 0.4.1 (released June 2025) requires Node.js >=24. It enforces security best practices including strict integer/number ranges, defined string maxLength and allowed values, safe array and object property limits, secure RegExp patterns, and safe $id/$ref resolution. Released under MIT license with SLSA 3 provenance and OpenSSF Scorecard. Differentiated by providing a comprehensive, security-focused meta-schema that checks JSON Schemas for common vulnerabilities, aligning with OWASP ASVS and NIST guidelines.","status":"active","version":"0.4.1","language":"javascript","source_language":"en","source_url":"https://github.com/willfarrell/sast-json-schema","tags":["javascript","JSON","Schema","SAST","Secure","Safe","ASVS","OWASP","NIST"],"install":[{"cmd":"npm install sast-json-schema","lang":"bash","label":"npm"},{"cmd":"yarn add sast-json-schema","lang":"bash","label":"yarn"},{"cmd":"pnpm add sast-json-schema","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"Used to compile and validate schemas against the meta-schema. Must be installed separately.","package":"ajv","optional":false}],"imports":[{"note":"Requires import attribute 'with { type: \"json\" }' to load the JSON file. Without it, Node.js may error on module resolution.","wrong":"import sastSchema from 'sast-json-schema'","symbol":"default (JSON)","correct":"import sastSchema from 'sast-json-schema' with { type: 'json' }"},{"note":"CommonJS require works directly; mispathing the file leads to undefined.","wrong":"const sastSchema = require('sast-json-schema/json')","symbol":"default (require)","correct":"const sastSchema = require('sast-json-schema')"},{"note":"Use subpath exports for specific JSON Schema drafts. Available: /2020-12, /2019-09, /draft-07, /draft-06, /draft-04.","wrong":"import schema2020 from 'sast-json-schema/2020-12'","symbol":"per-draft import (ESM)","correct":"import schema2020 from 'sast-json-schema/2020-12' with { type: 'json' }"}],"quickstart":{"code":"import Ajv from \"ajv/dist/2020.js\";\nimport sastSchema from \"sast-json-schema\" with { type: \"json\" };\nimport schema from \"./example.json\" with { type: \"json\" };\n\n// Validate your schema with strictTypes:true\nconst userAjv = new Ajv({ strictTypes: true });\nif (!userAjv.validateSchema(schema)) {\n  console.error(\"Schema validation errors:\", userAjv.errors);\n}\n\n// SAST check using the meta-schema (needs strictTypes:false because subschemas may be false)\nconst sastAjv = new Ajv({ strictTypes: false });\nconst isSchemaSecure = sastAjv.compile(sastSchema);\nif (!isSchemaSecure(schema)) {\n  console.error(\"Security issues:\", isSchemaSecure.errors);\n}","lang":"javascript","description":"Validates a JSON Schema against the SAST meta-schema to detect security vulnerabilities. Uses Ajv 2020 edition."},"warnings":[{"fix":"Upgrade Node.js to version 24 or later.","message":"Requires Node.js version >=24. Older versions are not supported and will fail to install/run.","severity":"gotcha","affected_versions":"<0.4.0"},{"fix":"Create a separate Ajv instance with strictTypes: false for SAST validation.","message":"The meta-schema uses strictTypes:false in Ajv because subschemas may be boolean (false). Using strictTypes:true will cause validation errors.","severity":"gotcha","affected_versions":">=0.0.0"},{"fix":"Append ' with { type: \"json\" }' to the import statement.","message":"Import attribute 'with { type: \"json\" }' is required in ESM. Omitting it causes Node.js to throw ERR_IMPORT_ASSERTION_TYPE_MISSING.","severity":"gotcha","affected_versions":">=0.0.0"},{"fix":"","message":"No deprecation warnings currently. Version 0.4.1 is the latest stable release.","severity":"deprecated","affected_versions":">=0.4.1"}],"env_vars":null,"search_vec":"'0.4.1':21 '2025':24 '24':27 '3':63 'align':86 'allow':41 'applic':12 'array':44 'asv':89,99 'best':31 'check':80 'common':84 'comprehens':72 'current':19 'defin':37 'differenti':68 'enforc':29 'focus':75 'guidelin':92 'id':54 'includ':33 'integer/number':35 'javascript':93 'json':3,17,81,94 'june':23 'licens':60 'limit':48 'maxlength':39 'meta':7,77 'meta-schema':6,76 'mit':59 'nist':91,101 'node.js':26 'object':46 'openssf':66 'owasp':88,100 'pattern':51 'perform':10 'practic':32 'properti':47 'proven':64 'provid':70 'rang':36 'ref':55 'regexp':50 'releas':22,57 'requir':25 'resolut':56 'safe':43,53,98 'sast':2,15,96 'sast-json-schema':1 'schema':4,8,18,78,82,95 'scorecard':67 'secur':13,30,49,74,97 'security-focus':73 'slsa':62 'static':11 'strict':34 'string':38 'test':14 'valu':42 'version':20 'vulner':85","created_at":"2026-06-07T17:00:57.187374+00:00","updated_at":"2026-06-07T17:00:57.187374+00:00","problems":[{"fix":"Install Ajv version 8 or later: npm install ajv@latest","cause":"Using Ajv version 7 or earlier which does not have validateSchema method.","error":"TypeError: ajv.validateSchema is not a function"},{"fix":"Use: import sastSchema from 'sast-json-schema' with { type: 'json' }","cause":"Missing or incorrect import attribute for JSON module in ESM.","error":"Error [ERR_IMPORT_ASSERTION_TYPE_MISSING]: Module \"sast-json-schema\" needs an import attribute of type \"json\""},{"fix":"Check available drafts: /2020-12, /2019-09, /draft-07, /draft-06, /draft-04 are all valid.","cause":"Attempting to import a draft version that does not exist in the package exports.","error":"Cannot find module 'sast-json-schema/draft-04'"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/willfarrell/sast-json-schema/","github":"https://github.com/willfarrell/sast-json-schema","docs":null,"changelog":null,"pypi":null,"npm":"sast-json-schema","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-07","next_check":"2026-09-05","install_tag":null}}