fix(checkExact): detect unknown fields under wildcard when specific sub-paths are declared#1362
Open
mahmoodhamdi wants to merge 1 commit intoexpress-validator:masterfrom
Conversation
…ub-paths are declared
When a wildcard field (e.g. body('*')) and more specific sub-paths (e.g. body('*.id'),
body('*.qty')) are both registered with checkExact, unknown nested fields were not
detected. The wildcard's leaf marker ('') in the tree caused findUnknownFields to
short-circuit and treat all descendants as implicitly known, even when specific
sub-paths defined constrained knowledge.
Introduce isCoveredAsWhole() which only returns true when the '' leaf is present
and there are no more-specific sub-keys. When specific sub-keys co-exist with '',
they take precedence and define exactly what is known, so unregistered nested
fields are correctly flagged as unknown.
Fixes express-validator#1242
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1242.
When
checkExactis used together with wildcard validation chains (e.g.body('*').isObject()) alongside specific sub-path chains (e.g.body('*.id'),body('*.qty')), unknown nested fields inside array elements are not detected. A field likewrongin[{ id: 1, qty: 100 }, { id: 2, wrong: 1, qty: 100 }]passescheckExactwithout any error.Root Cause
selectUnknownFieldsbuilds a tree of known field paths. Whenbody('*')is registered, it creates the tree{ '*': { '': {} } }. The''leaf infindUnknownFieldsmeans "this branch is validated as a whole — all descendants are implicitly known", causing the function to short-circuit and skip children. This happens even when more specific sub-paths like*.idand*.qtyare also in the tree (producing{ '*': { '': {}, 'id': { '': {} }, 'qty': { '': {} } } }), because the''check fires first.Fix
Introduce
isCoveredAsWhole(tree)which returnstrueonly when:''leaf is present, AND''and'**')When specific sub-keys co-exist with
'', those sub-keys define constrained knowledge. The''marker means "the field's value is validated" but does NOT imply all descendants are implicitly known. Anything not listed as a specific sub-key is flagged as unknown.Behaviour
['*']only[{ id: 1, extra: 2 }]['*', '*.id', '*.qty'][{ id: 1, qty: 100, wrong: 1 }][0].wrong['*.id', '*.qty'][{ id: 1, qty: 100, wrong: 1 }][0].wrongTest plan
src/middlewares/exact.spec.tscovering the wildcard + specific sub-paths scenario with bothcheckExactchains andcheckSchema.src/field-selection.spec.tscoveringselectUnknownFieldsdirectly.npm test).