addressed pr comments

jayalfredprufrock · Jun 3, 2024 · ef9d94f · ef9d94f
1 parent 793a2f9
commit ef9d94f
Show file tree

Hide file tree

Showing 4 changed files with 31 additions and 13 deletions.
diff --git a/package.json b/package.json
@@ -26,8 +26,8 @@
         "@nestjs/core": "^9.0.1 || ^10.0.3",
         "@nestjs/swagger": "^6.1.1 || ^7.0.11",
         "@sinclair/typebox": "^0.32.4",
-        "rxjs": "^7.5.6",
-        "ajv": "^8.14.0"
+        "ajv": "^8.14.0",
+        "rxjs": "^7.5.6"
     },
     "devDependencies": {
         "@changesets/cli": "^2.26.2",
@@ -63,5 +63,8 @@
     "repository": {
         "type": "git",
         "url": "https://github.com/jayalfredprufrock/nestjs-typebox"
+    },
+    "dependencies": {
+        "fast-uri": "^2.3.0"
     }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/decorators.ts b/src/decorators.ts
@@ -6,6 +6,7 @@ import { ApiBody, ApiOperation, ApiParam, ApiQuery } from '@nestjs/swagger';
 import { DECORATORS } from '@nestjs/swagger/dist/constants.js';
 import { Static, TSchema, Type, TypeGuard } from '@sinclair/typebox';
 import { Ajv } from 'ajv';
+import fastUri from 'fast-uri';
 
 import { AjvValidationException } from './exceptions.js';
 import { TypeboxTransformInterceptor } from './interceptors.js';
@@ -22,7 +23,16 @@ import type {
 } from './types.js';
 import { capitalize, coerceType, isObj } from './util.js';
 
-const ajv = new Ajv();
+const ajv = new Ajv({
+    coerceTypes: 'array',
+    useDefaults: true,
+    removeAdditional: true,
+    uriResolver: fastUri,
+    addUsedSchema: false,
+    // Explicitly set allErrors to `false`.
+    // When set to `true`, a DoS attack is possible.
+    allErrors: false,
+});
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function isSchemaValidator(type: any): type is SchemaValidator {

diff --git a/src/types.ts b/src/types.ts
@@ -16,7 +16,7 @@ export type MethodDecorator<T extends Function = any> = (
 ) => TypedPropertyDescriptor<T> | void;
 
 export interface HttpEndpointDecoratorConfig<
-    TTSchema extends TSchema = TSchema,
+    TTSchema extends TSchema,
     ResponseConfig extends ResponseValidatorConfig<TTSchema> = ResponseValidatorConfig<TTSchema>,
     RequestConfigs extends RequestValidatorConfig[] = RequestValidatorConfig[],
 > extends Omit<ApiOperationOptions, 'requestBody' | 'parameters'> {
@@ -26,7 +26,7 @@ export interface HttpEndpointDecoratorConfig<
     validate?: ValidatorConfig<TTSchema, ResponseConfig, RequestConfigs>;
 }
 
-export interface SchemaValidator<TTSchema extends TSchema = TSchema> {
+export interface SchemaValidator<TTSchema extends TSchema> {
     schema: TTSchema;
     name: string;
     check: ValidateFunction<Static<TTSchema>>;
@@ -40,40 +40,38 @@ export interface ValidatorConfigBase<TTSchema extends TSchema> {
     required?: boolean;
     pipes?: (PipeTransform | Type<PipeTransform>)[];
 }
-export interface ResponseValidatorConfig<TTSchema extends TSchema = TSchema> extends ValidatorConfigBase<TTSchema> {
+export interface ResponseValidatorConfig<TTSchema extends TSchema> extends ValidatorConfigBase<TTSchema> {
     schema: TTSchema;
     type?: 'response';
     responseCode?: number;
     required?: true;
     pipes?: never;
 }
 
-export interface ParamValidatorConfig<TTSchema extends TSchema = TSchema> extends ValidatorConfigBase<TTSchema> {
+export interface ParamValidatorConfig<TTSchema extends TSchema> extends ValidatorConfigBase<TTSchema> {
     schema?: TTSchema;
     type: 'param';
     name: string;
     stripUnknownProps?: never;
 }
 
-export interface QueryValidatorConfig<TTSchema extends TSchema = TSchema> extends ValidatorConfigBase<TTSchema> {
+export interface QueryValidatorConfig<TTSchema extends TSchema> extends ValidatorConfigBase<TTSchema> {
     schema?: TTSchema;
     type: 'query';
     name: string;
     stripUnknownProps?: never;
 }
 
-export interface BodyValidatorConfig<TTSchema extends TSchema = TSchema> extends ValidatorConfigBase<TTSchema> {
+export interface BodyValidatorConfig<TTSchema extends TSchema> extends ValidatorConfigBase<TTSchema> {
     schema: TTSchema;
     type: 'body';
 }
 
-export type RequestValidatorConfig<TTSchema extends TSchema = TSchema> =
+export type RequestValidatorConfig<TTSchema extends TSchema> =
     | ParamValidatorConfig<TTSchema>
     | QueryValidatorConfig<TTSchema>
     | BodyValidatorConfig<TTSchema>;
-export type SchemaValidatorConfig<TTSchema extends TSchema = TSchema> =
-    | RequestValidatorConfig<TTSchema>
-    | ResponseValidatorConfig<TTSchema>;
+export type SchemaValidatorConfig<TTSchema extends TSchema> = RequestValidatorConfig<TTSchema> | ResponseValidatorConfig<TTSchema>;
 
 export type ValidatorType = NonNullable<SchemaValidatorConfig['type']>;