Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Literal and enum validation errors contain input data #461

Closed
pasieronen opened this issue May 22, 2021 · 0 comments
Closed

Literal and enum validation errors contain input data #461

pasieronen opened this issue May 22, 2021 · 0 comments

Comments

@pasieronen
Copy link
Contributor

Normally ZodError does not contain the actual value that was invalid. IMHO this is good - errors are often logged, and there are many situations where you don't want to log the value - the value could be sensitive (credit card number, personally identifiable information, password/secret token of some kind), or it might be unsafe to log (might be several gigabytes, contain newlines, NUL bytes, ANSI terminal escape sequences, HTML, ... - some of which might cause problems when viewing logs later).

However, for z.literal and z.enum, the message does contain the input data:

> z.literal('Foo').parse('Bar')
Uncaught ZodError: [
  {
    "code": "invalid_type",
    "expected": "Foo",
    "received": "Bar",
    "path": [],
    "message": "Expected Foo, received Bar"
  }
]
<snip>

> z.enum(['Foo','Bar']).parse('Bad')
Uncaught ZodError: [
  {
    "code": "invalid_enum_value",
    "options": [
      "Foo",
      "Bar"
    ],
    "path": [],
    "message": "Invalid enum value. Expected 'Foo' | 'Bar', received 'Bad'"
  }
]
<snip>
```

I would suggest aligning these two with the other errors (it looks like these are the only two exceptions), so that logged error messages can never contain the invalid input data itself.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant