Rules Hub
Code Ruleset
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Validate object shape and prevent unsafe prototype merges
Control unknown keys and avoid unsafe recursive merges; validated stripping can be as intentional as strict rejection.
Bad example
| 1 | function mergeSettings(target: Record<string, unknown>, raw: Record<string, unknown>) { |
| 2 | for (const key of Object.keys(raw)) target[key] = raw[key]; |
| 3 | return target; |
| 4 | } |
Explanation (EN)
Unchecked dynamic assignment can change the target object prototype through __proto__ and write fields the schema never approved.
Objašnjenje (HR)
Neprovjereni dinamički upis preko __proto__ može promijeniti prototip ciljnog objekta i zapisati polja koja shema nije odobrila.
Good example
| 1 | const Settings = z.object({ name: z.string(), theme: z.enum(["light", "dark"]) }); |
| 2 | const parsed = Settings.parse(rawInput); |
| 3 | const settings = { name: parsed.name, theme: parsed.theme }; |
Explanation (EN)
Under the configured stripping policy, only validated known output fields are used. Use the library's strict-object mode instead if unknown keys must fail.
Objašnjenje (HR)
Uz postavljenu politiku uklanjanja koriste se samo poznata validirana izlazna polja. Ako nepoznati ključevi moraju biti pogreška, koristi strogi način biblioteke.
Notes (EN)
Choose an explicit unknown-key policy and consume only the validated output. Build known domain fields explicitly rather than recursively merging attacker-controlled keys into ordinary objects.
Bilješke (HR)
Izričito odredi politiku nepoznatih ključeva i koristi samo validirani izlaz. Poznata domenska polja izgradi izravno umjesto rekurzivnog spajanja ključeva pod kontrolom napadača u obične objekte.
Exceptions / Tradeoffs (EN)
Stripping unknown fields can safely prevent over-posting when the raw input is discarded; strict rejection is a contract choice, not the only secure policy. Open maps need constrained keys/values and prototype-safe handling. Verify exact validator options for the installed version.
Iznimke / Tradeoffi (HR)
Uklanjanje nepoznatih polja može sigurno spriječiti over-posting ako se sirovi unos odbaci. Strogo odbijanje je izbor ugovora, a ne jedina sigurna politika. Otvorene mape trebaju ograničene ključeve i vrijednosti te postupanje sigurno za prototipove. Provjeri opcije instalirane verzije validatora.