Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: set forbidUnknownValues to true by default #1403

Closed

Conversation

mikeguta
Copy link

Description

This is an attempted fix for #438
It does so with a breaking change that uses a safe default of true for forbidUnknownValues. Only an explicit false value would preserve the previous default behaviour.

Checklist

  • the pull request title describes what this PR does (not a vague title like Update index.md)
  • the pull request targets the default branch of the repository (develop)
  • the code follows the established code style of the repository
    • npm run prettier:check passes
    • npm run lint:check passes
  • tests are added for the changes I made (if any source code was modified)
  • documentation added or updated
  • I have run the project locally and verified that there are no errors

Fixes

fixes #438

Other

35f8d20 Moved @types/validator to devDependencies
1b6af93 Fixed a couple of tests that were not returning promises and failing silently

dependabot bot added 30 commits April 13, 2021 08:40
@mikeguta mikeguta changed the title Fix 438 forbid unknown values fix: #438 default forbidUnknownValues to true Nov 17, 2021
@mikeguta mikeguta marked this pull request as ready for review November 18, 2021 08:17
`No metadata found. There is more than once class-validator version installed probably. You need to flatten your dependencies.`
`No metadata found. There is more than one class-validator version installed probably. You need to flatten your dependencies.`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change seems to no belong in this PR, and there is another PR for this already #1127

@michaeljauk
Copy link

Is this going to be merged anytime soon?

@NoNameProvided NoNameProvided changed the title fix: #438 default forbidUnknownValues to true fix: set forbidUnknownValues to true by default Nov 20, 2022
@NoNameProvided
Copy link
Member

This PR contains various unrelated changes, but I think all of this is landed already.

The significant change of setting forbidUnknownValues to true by default was merged in #1798.

The changed tests seem fine for me on develop now and re-adding @types/validator has an open PR.

@NoNameProvided NoNameProvided added the status: superset by another Issue or task being tracked/handled in a different issue. label Nov 20, 2022
@github-actions
Copy link

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Dec 21, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
status: superset by another Issue or task being tracked/handled in a different issue.
Development

Successfully merging this pull request may close these issues.

fix: default settings allows arbitrary bypass vulnerability
6 participants