kakasoo / kakasoo/DeepStrictTypes
[BUG] Data leak in `deepStrictPick` runtime when array element lacks key
- Dominant language
- TypeScript
- Stars
- 64
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
# Bug Report
**Description**
In `deepStrictPick` and `deepStrictAssert`, when traversing arrays, if a specific element does not have the specified key, that element is returned **as-is**. This is a security/type-safety bug where fields that should not be picked are leaked.
**Type Issue Example**
When picking a key that only exists in some array elements, other fields are leaked from elements that lack the key.
**Type Input**
```typescript
const data = {
items: [
{ id: 1, name: "Alice", secret: "password123" },
{ id: 2, name: "Bob", secret: "hunter2" },
],
};
const result = deepStrictPick(data, 'items[*].id');
// Expected: { items: [{ id: 1 }, { id: 2 }] }
// Actual: Works correctly (this case is OK)
// Problem case: when key exists only in some elements
const mixed = {
items: [
{ id: 1, extra: "yes" },
{ name: "Bob" }, // no id key
],
};
const result2 = deepStrictPick(mixed as any, 'items[*].id');
// Expected: { items: [{ id: 1 }, {}] }
// Actual: { items: [{ id: 1 }, { name: "Bob" }] } (name is leaked)
```
**Affected Files**
| File | Line | Issue |
|------|------|-------|
| `src/functions/DeepStrictPick.ts` | 42-43 | `return element;` — returns original instead of empty object when key is missing |
| `src/functions/DeepStrictAssert.ts` | 42-43 | Same pattern |
**Fix**
```typescript
// Before (line 42-43):
return element;
// After:
return {};
```
**Test Requirements**
All changes must include the following tests:
1. **Backward Compatibility**
- All existing `deepStrictPick` and `deepStrictAssert` tests must pass
- Add tests to verify that existing type behavior remains unchanged
2. **Fix Verification**
- Verify empty object is returned when array element lacks the key
- Runtime verification with `typia.random()` + assert
3. **Complex Type Stability**
- Partial key existence in nested arrays (`items[*].nested[*].id`)
- 2-level arrays (`items[*].sub[*].value`)
- Arrays with mixed Date properties
- Empty array input (`{ items: [] }`)
**How to verify:**
```bash
npm run build:test && npm run test
npm run prettier
```
Contributor guide
Research direction
Start with src/functions/DeepStrictPick.ts and src/functions/DeepStrictAssert.ts at the reported lines, then inspect the existing deepStrictPick and deepStrictAssert tests. Run npm run build:test && npm run test before making changes. Done means missing keys in array elements no longer leak fields, while nested-array, two-level-array, Date, empty-array, backward-compatibility, and typia.random assertions pass; finish with npm run prettier.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100