custom decorater not throws an error on extra property passed #15125
Description
Is there an existing issue for this?
- I have searched the existing issues
Current behavior
export class PaginationDto {
@Min(1) @IsNumber(undefined, { message: 'must be a valid number' }) @IsOptional()
page?: PageType;
@Min(1) @Max(25) @IsNumber(undefined, { message: 'must be a valid number' }) @IsOptional()
limit?: LimitType;
@IsString() @IsOptional()
sort?: SortType;
}
custom decorater
export const Paginate = createParamDecorator(
(_data: unknown, ctx: ExecutionContext) => {
const request = ctx.switchToHttp().getRequest();
// Helper function to safely parse numbers or return a default
const parseNumber = (value: any): number => {
const num = Number(value);
return isNaN(num) ? value : num;
};
const page = parseNumber(request.query?.page);
const limit = parseNumber(request.query?.limit);
const sort = request.query?.sort || 'createdAt';
return JSON.parse(JSON.stringify({ page, limit, sort }));
},
);
controller
@Get('test')
findAllg(
@Paginate() paginate: PaginationDto,
) {
console.log(paginate)
return 'test'
}
main.ts
app.useGlobalPipes(
new ValidationPipe({
whitelist: true,
forbidNonWhitelisted: true,
validateCustomDecorators: true,
transform: true,
stopAtFirstError: true,
}),
);
Minimum reproduction code
https://github.com/boy-scripter/nestjs-pagination
Steps to reproduce
No response
Expected behavior
i am expecting it validates and throws an error which fields is not defined in dto
but not throwing when i pass any extra paramters in request
like request = ?hack=true
this is not throwing an error
Package
- I don't know. Or some 3rd-party package
-
@nestjs/common -
@nestjs/core -
@nestjs/microservices -
@nestjs/platform-express -
@nestjs/platform-fastify -
@nestjs/platform-socket.io -
@nestjs/platform-ws -
@nestjs/testing -
@nestjs/websockets - Other (see below)
Other package
No response
NestJS version
No response
Packages versions
Node.js version
No response
In which operating systems have you tested?
- macOS
- Windows
- Linux
Other
No response