dspace-angular
dspace-angular copied to clipboard
Dynamic form date picker & parser may use date values unsafely
Describe the bug
The dynamic form library we use defines date values as string | object | Date.
We assume that value.toString() is date-like in at least two places:
- https://github.com/DSpace/dspace-angular/blob/0a1764c65ad8cfd0a8e74776cee36073723681c4/src/app/shared/form/builder/ds-dynamic-form-ui/models/date-picker/date-picker.component.ts#L99-L113
- https://github.com/DSpace/dspace-angular/blob/0a1764c65ad8cfd0a8e74776cee36073723681c4/src/app/shared/form/builder/parsers/date-field-parser.ts#L21-L32
While this may work for Date, it may not for an arbitrary object.
As far as I know we haven't seen any problems directly related to this though.
Expected behavior We should handle all supported types, at least by throwing an informative error if the arbitrary object situation ever occurs.
Related work
Highlighted by the @typescript-eslint/no-base-to-string rule introduced in #2865