Fix resolver-validation validation snake trap (#12850)
# Introduction This PR might have a lot of impact on tested validation Avoid catching programmatically thrown error --------- Co-authored-by: Charles Bochet <charles@twenty.com>
This commit is contained in:
@ -10,6 +10,16 @@ import { ValidationError, validate } from 'class-validator';
|
||||
|
||||
import { UserInputError } from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
|
||||
|
||||
const safeClassValidatorValidateWrapper = async (
|
||||
object: object,
|
||||
): Promise<ValidationError[]> => {
|
||||
try {
|
||||
return await validate(object);
|
||||
} catch (error) {
|
||||
return [];
|
||||
}
|
||||
};
|
||||
|
||||
@Injectable()
|
||||
export class ResolverValidationPipe implements PipeTransform {
|
||||
async transform(value: unknown, metadata: ArgumentMetadata) {
|
||||
@ -20,22 +30,17 @@ export class ResolverValidationPipe implements PipeTransform {
|
||||
}
|
||||
|
||||
const object = plainToInstance(metatype, value);
|
||||
const errors = await safeClassValidatorValidateWrapper(object);
|
||||
|
||||
try {
|
||||
const errors = await validate(object);
|
||||
if (errors.length === 0) {
|
||||
// TODO shouldn't we return the object here ? As transpilation could bring mutations
|
||||
return value;
|
||||
}
|
||||
|
||||
if (errors.length > 0) {
|
||||
const errorMessage = this.formatErrorMessage(errors);
|
||||
|
||||
throw new UserInputError(errorMessage);
|
||||
}
|
||||
} catch (error) {
|
||||
// If the element is not a class, we can't validate it
|
||||
return value;
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
private toValidate(metatype: Type<any>): boolean {
|
||||
@ -50,6 +55,10 @@ export class ResolverValidationPipe implements PipeTransform {
|
||||
return Object.values(error.constraints);
|
||||
}
|
||||
|
||||
if (error.children) {
|
||||
return this.formatErrorMessage(error.children);
|
||||
}
|
||||
|
||||
return [];
|
||||
});
|
||||
|
||||
|
||||
Reference in New Issue
Block a user