Bug Report
Description
In deepStrictPick and deepStrictAssert, when traversing arrays, if a specific element does not have the specified key, that element is returned as-is. This is a security/type-safety bug where fields that should not be picked are leaked.
Type Issue Example
When picking a key that only exists in some array elements, other fields are leaked from elements that lack the key.
Type Input
const data = {
items: [
{ id: 1, name: "Alice", secret: "password123" },
{ id: 2, name: "Bob", secret: "hunter2" },
],
};
const result = deepStrictPick(data, 'items[*].id');
// Expected: { items: [{ id: 1 }, { id: 2 }] }
// Actual: Works correctly (this case is OK)
// Problem case: when key exists only in some elements
const mixed = {
items: [
{ id: 1, extra: "yes" },
{ name: "Bob" }, // no id key
],
};
const result2 = deepStrictPick(mixed as any, 'items[*].id');
// Expected: { items: [{ id: 1 }, {}] }
// Actual: { items: [{ id: 1 }, { name: "Bob" }] } (name is leaked)
Affected Files
| File |
Line |
Issue |
src/functions/DeepStrictPick.ts |
42-43 |
return element; — returns original instead of empty object when key is missing |
src/functions/DeepStrictAssert.ts |
42-43 |
Same pattern |
Fix
// Before (line 42-43):
return element;
// After:
return {};
Test Requirements
All changes must include the following tests:
-
Backward Compatibility
- All existing
deepStrictPick and deepStrictAssert tests must pass
- Add tests to verify that existing type behavior remains unchanged
-
Fix Verification
- Verify empty object is returned when array element lacks the key
- Runtime verification with
typia.random<Answer>() + assert
-
Complex Type Stability
- Partial key existence in nested arrays (
items[*].nested[*].id)
- 2-level arrays (
items[*].sub[*].value)
- Arrays with mixed Date properties
- Empty array input (
{ items: [] })
How to verify:
npm run build:test && npm run test
npm run prettier
Bug Report
Description
In
deepStrictPickanddeepStrictAssert, when traversing arrays, if a specific element does not have the specified key, that element is returned as-is. This is a security/type-safety bug where fields that should not be picked are leaked.Type Issue Example
When picking a key that only exists in some array elements, other fields are leaked from elements that lack the key.
Type Input
Affected Files
src/functions/DeepStrictPick.tsreturn element;— returns original instead of empty object when key is missingsrc/functions/DeepStrictAssert.tsFix
Test Requirements
All changes must include the following tests:
Backward Compatibility
deepStrictPickanddeepStrictAsserttests must passFix Verification
typia.random<Answer>()+ assertComplex Type Stability
items[*].nested[*].id)items[*].sub[*].value){ items: [] })How to verify: