如何根据“模式”过滤JSON对象

Question

I build a RESTful api with node.js and express / koa.

I want to filter the JSON data input - for security reasons as well to have only the needed business specific properties. After filtering the business-specific validation takes place.

How can I throw away unwanted JSON / JS object properties - ie properties not in my database schema as well as empty properties?

• Define Schema & filter according to this? Using eg https://github.com/alank64/json-schema-filter
• Any configurable filtering available?

Answer 1

I think joi is a good library for validation and normalization. You can also sometimes get away with something as simple as _.pick from lodash/underscore.

Answer 2

You may consider using JSON-schema validators.

http://json-schema.org/implementations.html

Validators benchmark: https://github.com/ebdrup/json-schema-benchmark

Disclaimer: I created ajv

Answer 3

From the documentation, joi.validate() can strip fields, but only fields that are Objects. I wrote this, avialable in a gist , which seems to work fine. It returns a new Object containing only those fields in the comparison object which have the same name and type as the corresponding field in the schema object:

// Recursively strip out fields in objects and subobjects
function stripFields(schema, obj) {
  var newObj = {};

  var schemaType = schema.constructor.name;
  var objType = obj.constructor.name;

  // If types match and this property is not an Object, return the value
  if (schemaType !== "Object") {
    if(schemaType === objType) {
      return obj;
    } else {
      return null;
    }
  }

  var keys = Object.keys(schema);
  keys.forEach(function(key) {
    if(key in obj) {
      // Get instance names for properties
      var schemaConstructor = schema[key].constructor.name;
      var objConstructor = obj[key].constructor.name;

      // Only copy fields with matching types.
      if (schemaConstructor === objConstructor) {
        // Handle cases with subObjects
        if (objConstructor === "Object") {
          var res = stripFields(schema[key], obj[key]);
          if (res !== null) {
            newObj[key] = res;
          }
        } else {
          //  Just copy in non-Object properties (String, Boolean, etc.)
          newObj[key] = obj[key];
        }
      }
    };
    if (newObj === {}) {
      return null;
    }
  });
  return newObj;
}

The following test cases properly strip out incorrect fields:

var stripFields = require("./stripfields");

var schema = {
  a: 1, 
  b: 1,
  c:{ 
      foo:"bar",
      obj:{nestedField:1}
  },
  d:[1]
};

var testObj1 = {
  a: 7,
  b: 8,
  c:{
      foo:"bar"
  },
  d:[4,5]
};

var testObj2 = {
  a: 1,
  b: 2,
  c:{
      foo:"bar",
      obj:{nestedField:213}
  },
  d:[1,3,4],
  e:"someOtherField"
};

var testObj3 = {
  a: 1,
  c:{
      foo:"some string",
      bar:1
  },
  d:"string instead of array"
};


var res1 = stripFields(schema, testObj1);
var res2 = stripFields(schema, testObj2);
var res3 = stripFields(schema, testObj3);
var res4 = stripFields([1,2,3], ["a"]);

console.log("Results:");
console.log(res1);
console.log(res2);
console.log(res3);
console.log(res4);

Results:

Results:
{ a: 7, b: 8, c: { foo: 'bar' }, d: [ 4, 5 ] }
{ a: 1,
  b: 2,
  c: { foo: 'bar', obj: { nestedField: 213 } },
  d: [ 1, 3, 4 ] }
{ a: 1, c: { foo: 'some string' } }
[ 'a' ]