Use static config validation with built in widgets to pass CSP without unsafe-eval
Closes #2138
Summary
Follow up to our proposal in https://github.com/netlify/netlify-cms/issues/2138#issuecomment-998741205 to introduce static config validation that allows Netlify CMS to run in environments where Content Security Policy (CSP) prevents runtime code eval with unsafe-eval rule.
This PR introduces a number of changes to make this work,
- Upgraded
ajvpackage to8.8.2&ajv-keywordsto5.0.0innetlify-cms-coreworkspace - Added
ajv-clias a dependency tonetlify-cms-core - Validation schema necessary to validate all of the built in widgets was extracted to
packages/netlify-cms-core/config.schema.json - Added
write-validate-schemato package.json ofnetlify-cms-corewhich usesajvCLI command to generatepackage/netlify-cms-core/src/constants/staticValidateConfig.js package/netlify-cms-core/validation-rules/{instanceof.js,uniqueItemProprties.js}created with support forajv@8which is not supported inajv-keywordsvalidateConfigfunction modified to check if there are any custom widgets with custom schema. When no custom schemas are present, NetlifyCMS config validation defaults to usestaticValidateConfig.jsinstead of dynamic validation- Removed
ajv-errorsbecauseerrorMessagekeyword is not used in the schema
Test plan
Refactored configSchema.spec.js to run tests for dynamic and static validation.
TODO
- [ ] TypeScript needs to be upgraded because AJV 8 uses TypeScript 4 which includes definitions that can not pass
tsc --noEmit.
Checklist
Please add a x inside each checkbox:
- [ ] I have read the contribution guidelines.
- [ ] Code is formatted via running
yarn format. - [ ] Tests are passing via running
yarn test. - [ ] The status checks are successful (continuous integration). Those can be seen below.
A picture of a cute animal (not mandatory but encouraged)
Picture of my husky at the Pacific Ocean

@erezrokah this PR is going to be blocked by the fact that ajv@8 uses TypeScript 4+ and has syntax in type definition files that is not supported by TypeScript 3 used by this project. As a result, tests pass but type check fails. I'm not sure what to do with this because it's out of scope of this particular issue.
@taras are you still interested in moving this forward?