🧹 chore: merge main

CHANGELOG.md

@@ -1,3 +1,11 @@
+# 1.1.24 - 31 Oct 2024
+Security:
+- [#891](https://github.com/elysiajs/elysia/pull/891) Upgrade Cookie to 0.7.x to fix CVE-2024-47764
+
+Bug fix:
+- [#885](https://github.com/elysiajs/elysia/pull/885) unwrap transform errors
+- [#903](https://github.com/elysiajs/elysia/pull/903) typebox object schemas without properties key
+
 # 1.1.23 - 22 Oct 2024
 Bug fix:
 - Handle object with `.then` even if it's not promise (looking at you, Drizzle)

package.json

@@ -142,6 +142,7 @@
 	"devDependencies": {
 		"@types/benchmark": "^2.1.5",
 		"@types/bun": "^1.1.2",
+		"@types/cookie": "^1.0.0",
 		"@typescript-eslint/eslint-plugin": "^6.17.0",
 		"@typescript-eslint/parser": "^6.17.0",
 		"benchmark": "^2.1.4",

src/compose.ts

@@ -73,6 +73,7 @@ export const hasAdditionalProperties = (
 		const properties = schema.properties as Record<string, TAnySchema>
 
 		if ('additionalProperties' in schema) return schema.additionalProperties
+		if ('patternProperties' in schema) return false
 
 		for (const key of Object.keys(properties)) {
 			const property = properties[key]
@@ -2226,6 +2227,7 @@ export const composeErrorHandler = (app: AnyElysia) => {
 
 	fnLiteral +=
 		`if(error.constructor.name==="ValidationError"||error.constructor.name==="TransformDecodeError"){` +
+		`if(error.error)error=error.error\n` +
 		`set.status = error.status??422\n` +
 		adapter.validationError +
 		`}else{` +

src/dynamic-handle.ts

@@ -15,6 +15,7 @@ import { redirect, signCookie, StatusMap } from './utils'
 import { parseCookie } from './cookies'
 
 import type { Handler, LifeCycleStore, SchemaValidator } from './types'
+import { TransformDecodeError } from '@sinclair/typebox/value'
 
 // JIT Handler
 export type DynamicHandler = {
@@ -423,11 +424,13 @@ export const createDynamicHandler = (app: AnyElysia) => {
 			// @ts-expect-error
 			return (context.response = mapResponse(response, context.set))
 		} catch (error) {
-			if ((error as ElysiaErrors).status)
-				set.status = (error as ElysiaErrors).status
-
+			const reportedError = (error instanceof TransformDecodeError && error.error)
+				? error.error
+				: error
+			if ((reportedError as ElysiaErrors).status)
+				set.status = (reportedError as ElysiaErrors).status
 			// @ts-expect-error private
-			return app.handleError(context, error)
+			return app.handleError(context, reportedError)
 		} finally {
 			for (const afterResponse of app.event.afterResponse)
 				await afterResponse.fn(context as any)

test/core/compose.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'bun:test'
+import { Type } from '@sinclair/typebox'
+import { hasAdditionalProperties } from '../../src/compose'
+
+describe('hasAdditionalProperties', () => {
+		it('should handle object schemas without properties key', () => {
+			const schema = Type.Intersect([
+				Type.Object({ a: Type.String() }),
+				// Record schemas does not have properties key, instead it has patternProperties
+				Type.Record(Type.Number(), Type.String())
+			])
+			expect(hasAdditionalProperties(schema)).toBe(false)
+	})
+})

test/core/handle-error.test.ts

@@ -223,4 +223,29 @@ describe('Handle Error', () => {
 			'x-test': 'Nagi'
 		})
 	})
+
+	it('handle error in Transform', async () => {
+		const route = new Elysia().get('/', ({ query: { aid } }) => aid, {
+			query: t.Object({
+				aid: t
+					.Transform(t.String())
+					.Decode((value) => {
+						throw new NotFoundError('foo')
+					})
+					.Encode((value) => `1`)
+			})
+		})
+
+		let response = await new Elysia({ aot: false })
+			.use(route)
+			.handle(req('/?aid=a'))
+		expect(response.status).toEqual(404)
+		expect(await response.text()).toEqual('foo')
+
+		response = await new Elysia({ aot: true })
+			.use(route)
+			.handle(req('/?aid=a'))
+		expect(response.status).toEqual(404)
+		expect(await response.text()).toEqual('foo')
+	})
 })