Pular para o conteúdo principal

Input Validation & Sanitization

How Gauzy validates and sanitizes all incoming data.

Validation Pipeline​

class-validator DTOs​

All input is validated using DTOs with class-validator decorators:

import { IsString, IsOptional, IsUUID, IsEnum } from "class-validator";

export class CreateTaskDTO {
  @IsString()
  title: string;

  @IsOptional()
  @IsString()
  description?: string;

  @IsUUID()
  projectId: string;

  @IsEnum(TaskStatusEnum)
  status: TaskStatusEnum;
}

Validation Pipe​

Applied via the @UseValidationPipe() decorator:

@Post('/')
@UseValidationPipe({ whitelist: true })
async create(@Body() entity: CreateTaskDTO) { ... }

Options​

OptionDescription
whitelistStrip properties not in the DTO
transformAuto-transform to DTO types
forbidNonWhitelistedThrow error for unknown properties

UUID Validation​

All ID parameters are validated with UUIDValidationPipe:

@Get('/:id')
async findById(@Param('id', UUIDValidationPipe) id: string) { ... }

Query Parameter Validation​

Query parameters use ParseJsonPipe and BaseQueryDTO:

@Get('/')
@UseValidationPipe()
async findAll(@Query() params: BaseQueryDTO<Task>) { ... }

SQL Injection Prevention​

TypeORM and MikroORM both use parameterized queries, preventing SQL injection:

// ✅ SAFE: Parameterized
this.repository.findOne({ where: { id } });

// ❌ UNSAFE: String interpolation
this.repository.query(`SELECT * FROM task WHERE id = '${id}'`);