class-validator icon indicating copy to clipboard operation
class-validator copied to clipboard

fix: ValidateNested allows empty arrays as objecs

Open Clashsoft opened this issue 1 year ago • 0 comments

Description

The ValidateNested decorator does not check if the value is actually an object. If the entire class consists of optional fields, it will pass validation.

Minimal code-snippet showcasing the problem

import {validate, IsOptional, IsInt, ValidateNested} from 'class-validator';
import {plainToClass, Type} from 'class-transformer';

export class GameSettings {
  @IsOptional()
  @IsInt()
  size?: number;
}

class Game {
  @IsOptional()
  // @IsObject() // with this, it works
  @ValidateNested()
  @Type(() => GameSettings)
  settings?: GameSettings;
}

const badGame = {settings: []};
const game = plainToClass(Game, badGame);

console.log(game); // Game { settings: [] }

validate(game).then(console.log); // []

Expected behavior

A validation error occurs, e.g. settings must be an object or settings must be an instance of GameSettings. This can be achieved with an addition @IsObject() or IsInstance(GameSettings) decorator, though that seems redundant.

Actual behavior

No validation error.

Clashsoft avatar May 23 '24 12:05 Clashsoft