Class-transformer: fix: plainToClass still has broken functionality regarding functions and classes

Created on 15 Feb 2021 · 8Comments · Source: typestack/class-transformer

Description

Previously described here: https://github.com/typestack/class-transformer/issues/276 and here: https://github.com/typestack/class-transformer/pull/374

The code in question happens around
https://github.com/typestack/class-transformer/blob/develop/src/TransformOperationExecutor.ts#L189

Basically, whenever a property is a function or a class, during transformation, there is attempt to invoke it, which, in case of function, results in erratic, unexpected behavior and in case of classes, it triggers an error:

13:50:08.396 ERROR TypeError: class constructors must be invoked with 'new'
    transform TransformOperationExecutor.js:160
    plainToClass ClassTransformer.js:14
    plainToClass index.js:14

Expected behavior

Transformation shouldn't instantiate classes or invoke functions.

Actual behavior

Explained above.

Simple testcase:

class SideBarItem {

  label: string;

  callback?: () => any;

  useClass: any;

}

init() {
   const item = plainToClass(SideBarItem, { label: 'Logout', callback: this.logout() });
}

logout() {
    // do something obviously dangerous here
}



md5-2eaba908715bb23f23d69380e17dee05



init() {
   const item = plainToClass(SideBarItem, { label: 'Logout', useClass: MyService });
}



md5-f3607c7063a7c3d86f3f6ebdbaef2dbb



// get a subvalue
let subValue: any = undefined;
if (this.transformationType === TransformationType.PLAIN_TO_CLASS) {
    subValue = value[valueKey];
}
else {
    if (value instanceof Map) {
        subValue = value.get(valueKey);
    }
    else if (value[valueKey] instanceof Function) {
        subValue = value[valueKey]();
    }
    else {
        subValue = value[valueKey];
    }
}

and this is, in fact, an autopatch, that I have to apply every install to class-transformer, unfortunately. Ideally, this should be incorporated into the package - or an explanation should be given, why there's an attempt to extract a "subvalue" (whatever that is) from a plain object at that stage, with suggestions how to work around this properly.

fixed fix

Source

sebastian-zarzycki-es

Most helpful comment

I am planning on working on the TypesStack repos on the weekend, but no promises.

NoNameProvided on 23 Mar 2021

👍2

All 8 comments

Well I am not sure about this change (class-transformer is messy and I never get to clean it up properly since I took it over) but tests are passing, so let's give it a go. Fixed in 90feca36d2b44b6c66428ccef9402b13b58f7e2e. It will be included in the next release.

NoNameProvided on 22 Feb 2021

❤1

Thanks for looking into this. Will definitely test the new version.

(edit: I see console.log in the referenced commit - should it be there?)

sebastian-zarzycki-es on 23 Feb 2021