You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Provide a clear and concise description of the issue, including what you expected to happen.
I noticed that every once in a blue moon, my tests for something that calls sign would fail with validator.isValid is not a function. After debugging, I managed to narrow it down. I'm using fast-check for tests, and their fc.object function sometimes generates objects that have keys like "__proto__", "valueOf", or "toString". Whenever an object like this is passed into sign, the validator.isValid error appears.
Reproduction
Most minimal reproduction I could create:
Create a new Node project, installing jsonwebtoken
I looked into the source code some more. Seems the issue is that the code iterates over the keys of the object (in validate) and checks for a validator by accessing schema[key]. In the case of keys like toString, __proto__, and valueOf, it does find a value, so the if (!validator) check doesn't trigger. It then tries to call validator.isValid, but since it's a function (or the prototype of the object), it crashes....
function validate(schema, allowUnknown, object, parameterName) {
if (!isPlainObject(object)) {
throw new Error('Expected "' + parameterName + '" to be a plain object.');
}
Object.keys(object)
.forEach(function(key) {
- const validator = schema[key];- if (!validator) {+ if (!Object.getOwnPropertyNames(schema).includes(key)) {
if (!allowUnknown) {
throw new Error('"' + key + '" is not allowed in "' + parameterName + '"');
}
return;
}
+ const validator = schema[key];
if (!validator.isValid(object[key])) {
throw new Error(validator.message);
}
});
}
(Though it's probably better to use Object.hasOwnProperty or lodash.has instead)
Description
I noticed that every once in a blue moon, my tests for something that calls
sign
would fail withvalidator.isValid
is not a function. After debugging, I managed to narrow it down. I'm using fast-check for tests, and theirfc.object
function sometimes generates objects that have keys like"__proto__"
,"valueOf"
, or"toString"
. Whenever an object like this is passed intosign
, thevalidator.isValid
error appears.Reproduction
Most minimal reproduction I could create:
jsonwebtoken
index.js
, add:node index.js
To reproduce the
fast-check
test that shows the different ways this error occurs:jest
,jsonwebtoken
, andfast-check
.jwt.test.js
, add:npx jest
TypeError: validator.isValid is not a function
is thrownEnvironment
^9.0.2
fast-check
The text was updated successfully, but these errors were encountered: