Merge branch 'main' into avoid-normalization-side-effects

Author: crishoj

CHANGELOG.md

@@ -1,3 +1,11 @@
+# 1.1.24 - 31 Oct 2024
+Security:
+- [#891](https://github.com/elysiajs/elysia/pull/891) Upgrade Cookie to 0.7.x to fix CVE-2024-47764
+
+Bug fix:
+- [#885](https://github.com/elysiajs/elysia/pull/885) unwrap transform errors
+- [#903](https://github.com/elysiajs/elysia/pull/903) typebox object schemas without properties key
+
 # 1.1.23 - 22 Oct 2024
 Bug fix:
 - Handle object with `.then` even if it's not promise (looking at you, Drizzle)

bun.lockb

@@ -1,7 +1,7 @@
 {
 	"name": "elysia",
 	"description": "Ergonomic Framework for Human",
-	"version": "1.1.23",
+	"version": "1.1.24",
 	"author": {
 		"name": "saltyAom",
 		"url": "https://github.com/SaltyAom",
@@ -104,14 +104,14 @@
 	},
 	"dependencies": {
 		"@sinclair/typebox": "0.32.34",
-		"cookie": "^0.6.0",
+		"cookie": "^1.0.1",
 		"fast-decode-uri-component": "^1.0.1",
 		"openapi-types": "^12.1.3"
 	},
 	"devDependencies": {
 		"@types/benchmark": "^2.1.5",
 		"@types/bun": "^1.1.2",
-		"@types/cookie": "^0.6.0",
+		"@types/cookie": "^1.0.0",
 		"@typescript-eslint/eslint-plugin": "^6.17.0",
 		"@typescript-eslint/parser": "^6.17.0",
 		"benchmark": "^2.1.4",

package.json

@@ -79,6 +79,7 @@ export const hasAdditionalProperties = (
 		const properties = schema.properties as Record<string, TAnySchema>
 
 		if ('additionalProperties' in schema) return schema.additionalProperties
+		if ('patternProperties' in schema) return false
 
 		for (const key of Object.keys(properties)) {
 			const property = properties[key]
@@ -2343,9 +2344,10 @@ export const composeErrorHandler = (
 	}
 
 	fnLiteral += `if(error.constructor.name === "ValidationError" || error.constructor.name === "TransformDecodeError") {
-		set.status = error.status ?? 422
+	    const reportedError = error.error ?? error
+		set.status = reportedError.status ?? 422
 		return new Response(
-			error.message,
+			reportedError.message,
 			{
 				headers: Object.assign(
 					{ 'content-type': 'application/json'},

src/compose.ts

@@ -17,6 +17,7 @@ import { redirect, signCookie, StatusMap } from './utils'
 import { parseCookie } from './cookies'
 
 import type { Handler, LifeCycleStore, SchemaValidator } from './types'
+import { TransformDecodeError } from '@sinclair/typebox/value'
 
 // JIT Handler
 export type DynamicHandler = {
@@ -420,11 +421,13 @@ export const createDynamicHandler =
 
 			return (context.response = mapResponse(response, context.set))
 		} catch (error) {
-			if ((error as ElysiaErrors).status)
-				set.status = (error as ElysiaErrors).status
-
+			const reportedError = (error instanceof TransformDecodeError && error.error)
+				? error.error
+				: error
+			if ((reportedError as ElysiaErrors).status)
+				set.status = (reportedError as ElysiaErrors).status
 			// @ts-expect-error private
-			return app.handleError(context, error)
+			return app.handleError(context, reportedError)
 		} finally {
 			for (const afterResponse of app.event.afterResponse)
 				await afterResponse.fn(context as any)

src/dynamic-handle.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'bun:test'
+import { Type } from '@sinclair/typebox'
+import { hasAdditionalProperties } from '../../src/compose'
+
+describe('hasAdditionalProperties', () => {
+		it('should handle object schemas without properties key', () => {
+			const schema = Type.Intersect([
+				Type.Object({ a: Type.String() }),
+				// Record schemas does not have properties key, instead it has patternProperties
+				Type.Record(Type.Number(), Type.String())
+			])
+			expect(hasAdditionalProperties(schema)).toBe(false)
+	})
+})

test/core/compose.test.ts

@@ -204,4 +204,25 @@ describe('Handle Error', () => {
 			'APIError'
 		)
 	})
+
+	it('handle error in Transform', async () => {
+		const route = new Elysia().get('/', ({query: {aid}}) => aid, {
+			query: t.Object({
+				aid: t.Transform(t.String())
+					.Decode((value) => {
+						throw new NotFoundError('foo')
+					})
+					.Encode((value) => `1`)
+			})
+		})
+
+		let response = await (new Elysia({ aot: false })).use(route).handle(req('/?aid=a'))
+		expect(response.status).toEqual(404)
+		expect(await response.text()).toEqual('foo')
+
+		response = await (new Elysia({aot: true})).use(route).handle(req('/?aid=a'))
+		expect(response.status).toEqual(404)
+		expect(await response.text()).toEqual('foo')
+	})
+
 })