Fix resolver-validation validation snake trap (#12850)

# Introduction
This PR might have a lot of impact on tested validation
Avoid catching programmatically thrown error

---------

Co-authored-by: Charles Bochet <charles@twenty.com>
This commit is contained in:
Paul Rastoin
2025-06-24 18:30:56 +02:00
committed by GitHub
parent b7e72c3aa6
commit b31845b7ba

View File

@ -10,6 +10,16 @@ import { ValidationError, validate } from 'class-validator';
import { UserInputError } from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
const safeClassValidatorValidateWrapper = async (
object: object,
): Promise<ValidationError[]> => {
try {
return await validate(object);
} catch (error) {
return [];
}
};
@Injectable()
export class ResolverValidationPipe implements PipeTransform {
async transform(value: unknown, metadata: ArgumentMetadata) {
@ -20,22 +30,17 @@ export class ResolverValidationPipe implements PipeTransform {
}
const object = plainToInstance(metatype, value);
const errors = await safeClassValidatorValidateWrapper(object);
try {
const errors = await validate(object);
if (errors.length === 0) {
// TODO shouldn't we return the object here ? As transpilation could bring mutations
return value;
}
if (errors.length > 0) {
const errorMessage = this.formatErrorMessage(errors);
throw new UserInputError(errorMessage);
}
} catch (error) {
// If the element is not a class, we can't validate it
return value;
}
return value;
}
// eslint-disable-next-line @typescript-eslint/no-explicit-any
private toValidate(metatype: Type<any>): boolean {
@ -50,6 +55,10 @@ export class ResolverValidationPipe implements PipeTransform {
return Object.values(error.constraints);
}
if (error.children) {
return this.formatErrorMessage(error.children);
}
return [];
});