immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-16 05:34:30 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

[PR #2149] [MERGED] feat(server): improve validation in controllers #9399

New Issue
Closed
opened 2026-02-05 14:04:03 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 14:04:03 +03:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/immich-app/immich/pull/2149
Author: @michelheusschen
Created: 4/2/2023
Status: ✅ Merged
Merged: 4/3/2023
Merged by: @alextran1502

Base: main ← Head: feat/server-validation-controllers

📝 Commits (2)

  • 74246b5 feat(server): improve validation in controllers
  • 5b8be93 set ValidationPipe config with decorator

📊 Changes

13 files changed (+54 additions, -24 deletions)

View changed files

📝 server/apps/immich/src/controllers/album.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/api-key.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/auth.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/device-info.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/job.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/oauth.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/search.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/server-info.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/share.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/system-config.controller.ts (+3 -2)
📝 server/apps/immich/src/controllers/user.controller.ts (+2 -3)
➕ server/apps/immich/src/decorators/use-validation.decorator.ts (+12 -0)
📝 server/libs/domain/src/system-config/dto/system-config.dto.ts (+10 -1)

📄 Description

Add whitelist: true to ValidationPipe of all refactored controllers to only keep properties of incoming DTOs that have decorators. All other properties are stripped. The current behavior could become an issue when a dto is passed as an object and used without further validation, for example when passing a DTO directly to the update function of a repository.

Nested objects are only validated when they are an instance of a class. This means that SystemConfigDto didn't have proper validation and nested values were empty after applying whitelist: true. This has been fixed in this PR.

class Dto {
    @IsNotEmpty()
    @IsString()
    validated: string;
    
    unvalidated: string;
}

// Update endpoint in controller
update(@Body() dto: Dto)

// Request body to update endpoint
{ validated: 'value', unvalidated: 'value', other: 10 }


// Current value of dto:
{ validated: 'value', unvalidated: 'value', other: 10 }

// Value of dto after adding `whitelist: true`
{ validated: 'value' }

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/immich-app/immich/pull/2149 **Author:** [@michelheusschen](https://github.com/michelheusschen) **Created:** 4/2/2023 **Status:** ✅ Merged **Merged:** 4/3/2023 **Merged by:** [@alextran1502](https://github.com/alextran1502) **Base:** `main` ← **Head:** `feat/server-validation-controllers` --- ### 📝 Commits (2) - [`74246b5`](https://github.com/immich-app/immich/commit/74246b5020241e36325b4f0591c94e0edf833c3d) feat(server): improve validation in controllers - [`5b8be93`](https://github.com/immich-app/immich/commit/5b8be93dfaf42deaca7fc287a01f83297eadaf9f) set ValidationPipe config with decorator ### 📊 Changes **13 files changed** (+54 additions, -24 deletions) <details> <summary>View changed files</summary> 📝 `server/apps/immich/src/controllers/album.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/api-key.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/auth.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/device-info.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/job.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/oauth.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/search.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/server-info.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/share.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/system-config.controller.ts` (+3 -2) 📝 `server/apps/immich/src/controllers/user.controller.ts` (+2 -3) ➕ `server/apps/immich/src/decorators/use-validation.decorator.ts` (+12 -0) 📝 `server/libs/domain/src/system-config/dto/system-config.dto.ts` (+10 -1) </details> ### 📄 Description Add `whitelist: true` to `ValidationPipe` of all refactored controllers to only keep properties of incoming DTOs that have decorators. All other properties are stripped. The current behavior could become an issue when a dto is passed as an object and used without further validation, for example when passing a DTO directly to the update function of a repository. Nested objects are only validated when they are an instance of a class. This means that `SystemConfigDto` didn't have proper validation and nested values were empty after applying `whitelist: true`. This has been fixed in this PR. ```ts class Dto { @IsNotEmpty() @IsString() validated: string; unvalidated: string; } // Update endpoint in controller update(@Body() dto: Dto) // Request body to update endpoint { validated: 'value', unvalidated: 'value', other: 10 } // Current value of dto: { validated: 'value', unvalidated: 'value', other: 10 } // Value of dto after adding `whitelist: true` { validated: 'value' } ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
OVERLORD added the pull-request label 2026-02-05 14:04:03 +03:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#9399
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?