kakasoo / kakasoo/DeepStrictTypes

[BUG] Data leak in `deepStrictPick` runtime when array element lacks key

Open
#48 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
64
Forks
2
PR merge metrics
No merged PRs in 30d

Description

# Bug Report

**Description**

In `deepStrictPick` and `deepStrictAssert`, when traversing arrays, if a specific element does not have the specified key, that element is returned **as-is**. This is a security/type-safety bug where fields that should not be picked are leaked.

**Type Issue Example**

When picking a key that only exists in some array elements, other fields are leaked from elements that lack the key.

**Type Input**

```typescript
const data = {
items: [
{ id: 1, name: "Alice", secret: "password123" },
{ id: 2, name: "Bob", secret: "hunter2" },
],
};

const result = deepStrictPick(data, 'items[*].id');
// Expected: { items: [{ id: 1 }, { id: 2 }] }
// Actual: Works correctly (this case is OK)

// Problem case: when key exists only in some elements
const mixed = {
items: [
{ id: 1, extra: "yes" },
{ name: "Bob" }, // no id key
],
};

const result2 = deepStrictPick(mixed as any, 'items[*].id');
// Expected: { items: [{ id: 1 }, {}] }
// Actual: { items: [{ id: 1 }, { name: "Bob" }] } (name is leaked)
```

**Affected Files**

| File | Line | Issue |
|------|------|-------|
| `src/functions/DeepStrictPick.ts` | 42-43 | `return element;` — returns original instead of empty object when key is missing |
| `src/functions/DeepStrictAssert.ts` | 42-43 | Same pattern |

**Fix**

```typescript
// Before (line 42-43):
return element;

// After:
return {};
```

**Test Requirements**

All changes must include the following tests:

1. **Backward Compatibility**
- All existing `deepStrictPick` and `deepStrictAssert` tests must pass
- Add tests to verify that existing type behavior remains unchanged

2. **Fix Verification**
- Verify empty object is returned when array element lacks the key
- Runtime verification with `typia.random()` + assert

3. **Complex Type Stability**
- Partial key existence in nested arrays (`items[*].nested[*].id`)
- 2-level arrays (`items[*].sub[*].value`)
- Arrays with mixed Date properties
- Empty array input (`{ items: [] }`)

**How to verify:**
```bash
npm run build:test && npm run test
npm run prettier
```

Contributor guide

Open the contributing guide

Research direction

Start with src/functions/DeepStrictPick.ts and src/functions/DeepStrictAssert.ts at the reported lines, then inspect the existing deepStrictPick and deepStrictAssert tests. Run npm run build:test && npm run test before making changes. Done means missing keys in array elements no longer leak fields, while nested-array, two-level-array, Date, empty-array, backward-compatibility, and typia.random assertions pass; finish with npm run prettier.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.