
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
typescript-object-validator
Advanced tools
A simple library for typescript projects to validating object shapes. You can use this package to declare the shape you'd like an object to align to. This is handy when you have a complex object (for example, an API response) and want to validate the object, AND have typescript recognize the shape.
import { validateObjectShape } from 'typescript-object-validator'
const elephantValidation = validateObjectShape(
'Elephant API response' // https://elephant-api.herokuapp.com/elephants/random
randomElephantResponse,
{
_id: 'string',
index: 'number',
name: 'string',
affiliation: 'string',
species: 'string',
sex: 'string',
fictional: 'boolean',
dob: 'string',
dod: 'string',
wikilink: 'string',
image: 'string',
note: 'string',
}
)
if (elephantValidation.valid === true) {
/*
At this point, elephantValidation.result will have the type of:
{
_id: 'string',
index: 'number',
name: 'string',
affiliation: 'string',
species: 'string',
sex: 'string',
fictional: 'boolean',
dob: 'string',
dod: 'string',
wikilink: 'string',
image: 'string',
note: 'string',
}
*/
console.log(elephantValidation.result.name)
// -> "Packy"
}
validateObjectShape
Can be used to validate an object:
import { validateObjectShape } from 'typescript-object-validator'
validateObjectShape(
objectDescription,
validationItem,
expectedObjectShape,
validationOptions
)
The result of the validation is an object with a valid
property which flags if the validation succeeded or failed, a result
object which is the validated and typed object, or an errors
array with error results.
const validationResult = validateObjectShape(
objectDescription,
validationItem,
expectedObjectShape,
validationOptions
)
// If the validation is successful
{
valid: true,
result: { ...validatedItem } // (the object you passed in, but typed!)
}
// If the validation fails
{
valid: false,
errors: [
'Expected Test obj.two to be type: number, was string',
]
}
validateObjectShape
will coerce values for you if it's able to. For example if you say the property age
is a number, but it's passed in as a string, validateObjectShape
will try convert it to a number for you in the result
object:
const validationResult = validateObjectShape(
'Coercion Example',
{ age: '30' },
{ age: number }
)
if (validationResult.valid === true) {
// validationResult.result.age -> 30
typeof validationResult.result.age === 'number'
}
The library also alows you to test nested objects and arrays, for example:
const validationResult = validateObjectShape(
'Nested Example',
{
age: '30',
meta: { group: 'Staff' }
names: [
{ fname: 'Jeff', lname: 'Thompson' },
{ fname: 'Jeff', lname: 'Thompson' }
]
},
{
age: number,
meta: { group: 'string' }
names: arrayOf({ fname: 'string', lname: 'string' })
}
)
There are a number of basic validation types available to use, and some helpers which allow you build more complex types:
Basic types
This package also understands more complex types such as arrays and optional types. You can import helper functions to assist you in building these.
Complex Types:
const result = validateObjectShape(
'Test obj',
{
one: 'string value',
two: 2,
three: true,
four: ['1', '2'],
five: [true, false],
six: [1, 2],
seven: 'whatever'
},
{
one: 'string',
two: 'number',
three: 'boolean',
four: arrayOf('string'),
five: arrayOf('boolean'),
six: arrayOf('number'),
seven: 'unknown',
eight: optional('boolean')
}
)
arrayOf
, setting this to true
will convert those properties to arrays for you, rather than returning an error. This is useful for example when converting from xml to json.const validationResult = validateObjectShape(
'Coercion Example',
{ names: { fname: 'Jeff', lname: 'Thompson' } },
{ names: arrayOf({ fname: 'string', lname: 'string' }) },
{ coerceValidObjectIntoArray: true }
)
/*
Converts names into an array. validationResult.result:
{ names: [{ fname: 'Jeff', lname: 'Thompson' }] }
*/
FAQs
TypeScript first object validator
We found that typescript-object-validator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.