Skip to content

[BUG] Data leak in deepStrictPick runtime when array element lacks key #48

@kakasoo

Description

@kakasoo

Bug Report

Description

In deepStrictPick and deepStrictAssert, when traversing arrays, if a specific element does not have the specified key, that element is returned as-is. This is a security/type-safety bug where fields that should not be picked are leaked.

Type Issue Example

When picking a key that only exists in some array elements, other fields are leaked from elements that lack the key.

Type Input

const data = {
  items: [
    { id: 1, name: "Alice", secret: "password123" },
    { id: 2, name: "Bob", secret: "hunter2" },
  ],
};

const result = deepStrictPick(data, 'items[*].id');
// Expected: { items: [{ id: 1 }, { id: 2 }] }
// Actual:   Works correctly (this case is OK)

// Problem case: when key exists only in some elements
const mixed = {
  items: [
    { id: 1, extra: "yes" },
    { name: "Bob" },  // no id key
  ],
};

const result2 = deepStrictPick(mixed as any, 'items[*].id');
// Expected: { items: [{ id: 1 }, {}] }
// Actual:   { items: [{ id: 1 }, { name: "Bob" }] }  (name is leaked)

Affected Files

File Line Issue
src/functions/DeepStrictPick.ts 42-43 return element; — returns original instead of empty object when key is missing
src/functions/DeepStrictAssert.ts 42-43 Same pattern

Fix

// Before (line 42-43):
return element;

// After:
return {};

Test Requirements

All changes must include the following tests:

  1. Backward Compatibility

    • All existing deepStrictPick and deepStrictAssert tests must pass
    • Add tests to verify that existing type behavior remains unchanged
  2. Fix Verification

    • Verify empty object is returned when array element lacks the key
    • Runtime verification with typia.random<Answer>() + assert
  3. Complex Type Stability

    • Partial key existence in nested arrays (items[*].nested[*].id)
    • 2-level arrays (items[*].sub[*].value)
    • Arrays with mixed Date properties
    • Empty array input ({ items: [] })

How to verify:

npm run build:test && npm run test
npm run prettier

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions