dspace-angular icon indicating copy to clipboard operation
dspace-angular copied to clipboard

Dynamic form date picker & parser may use date values unsafely

Open ybnd opened this issue 1 year ago • 0 comments

Describe the bug The dynamic form library we use defines date values as string | object | Date.

We assume that value.toString() is date-like in at least two places:

  • https://github.com/DSpace/dspace-angular/blob/0a1764c65ad8cfd0a8e74776cee36073723681c4/src/app/shared/form/builder/ds-dynamic-form-ui/models/date-picker/date-picker.component.ts#L99-L113
  • https://github.com/DSpace/dspace-angular/blob/0a1764c65ad8cfd0a8e74776cee36073723681c4/src/app/shared/form/builder/parsers/date-field-parser.ts#L21-L32

While this may work for Date, it may not for an arbitrary object. As far as I know we haven't seen any problems directly related to this though.

Expected behavior We should handle all supported types, at least by throwing an informative error if the arbitrary object situation ever occurs.

Related work Highlighted by the @typescript-eslint/no-base-to-string rule introduced in #2865

ybnd avatar Apr 18 '24 10:04 ybnd