Closed aooen closed 1 month ago
1.1.3
Microsoft Windows NT 10.0.22000.0 x64
import Elysia, { t } from 'elysia' const app = new Elysia().get('/', ({ query }) => query, { query: t.Object({ leading: t.String(), arr: t.Array(t.String()), trailing: t.String(), }), }) const res = await app.fetch(new Request('http://localhost/?leading=foo&arr=bar&arr=baz&trailing=qux')) console.log(await res.json())
{ "leading": "foo", "arr": ["bar", "baz"], "trailing": "qux", }
{ "leading": "foo", "arr": ["bar", "baz", "ling=qux"], "trailing": "qux", }
"ling=qux" appears to be 'trailing=qux'.slice('arr='.length). There's no validation of param key. This seems to be happening since version 1.1.0.
"ling=qux"
'trailing=qux'.slice('arr='.length)
Should have been fixed on e946da4, published under 1.1.4
What version of Elysia.JS is running?
1.1.3
What platform is your computer?
Microsoft Windows NT 10.0.22000.0 x64
What steps can reproduce the bug?
What is the expected behavior?
What do you see instead?
Additional information
"ling=qux"
appears to be'trailing=qux'.slice('arr='.length)
. There's no validation of param key. This seems to be happening since version 1.1.0.