fix: set forbidUnknownValues to true by default

README.md

@@ -139,7 +139,7 @@ export interface ValidatorOptions {
 }
 ```
 
-> It's highly advised to set `forbidUnknownValues: true` as it will prevent unknown objects from passing validation.
+> It's highly advised to not set `forbidUnknownValues: false` as it will allow unknown objects to bypass validation. The default is a safe value of `true`.
 
 ## Validation errors
 

package.json

@@ -36,30 +36,30 @@
     "test:ci": "jest --runInBand --no-cache --coverage --verbose"
   },
   "dependencies": {
-    "@types/validator": "^13.1.3",
-    "libphonenumber-js": "^1.9.12",
-    "validator": "^13.5.2"
+    "libphonenumber-js": "^1.9.43",
+    "validator": "^13.7.0"
   },
   "devDependencies": {
-    "@rollup/plugin-commonjs": "^17.1.0",
-    "@rollup/plugin-node-resolve": "^11.2.0",
-    "@types/jest": "^26.0.20",
-    "@types/node": "^14.14.35",
-    "@typescript-eslint/eslint-plugin": "^4.16.1",
-    "@typescript-eslint/parser": "^4.16.1",
-    "eslint": "^7.21.0",
-    "eslint-config-prettier": "^8.1.0",
-    "eslint-plugin-jest": "^24.3.2",
+    "@rollup/plugin-commonjs": "^21.0.1",
+    "@rollup/plugin-node-resolve": "^13.0.6",
+    "@types/jest": "^27.0.2",
+    "@types/node": "^16.11.7",
+    "@types/validator": "^13.7.0",
+    "@typescript-eslint/eslint-plugin": "^4.33.0",
+    "@typescript-eslint/parser": "^4.33.0",
+    "eslint": "^7.32.0",
+    "eslint-config-prettier": "^8.3.0",
+    "eslint-plugin-jest": "^25.2.4",
     "husky": "^4.3.8",
     "jest": "^26.6.3",
-    "lint-staged": "^10.5.4",
+    "lint-staged": "^12.0.2",
     "prettier": "^2.2.1",
     "reflect-metadata": "0.1.13",
     "rimraf": "3.0.2",
-    "rollup": "^2.42.3",
+    "rollup": "^2.60.0",
     "rollup-plugin-terser": "^7.0.2",
-    "ts-jest": "^26.5.3",
-    "ts-node": "^9.1.1",
-    "typescript": "^4.2.3"
+    "ts-jest": "^26.5.6",
+    "ts-node": "^10.4.0",
+    "typescript": "^4.2.4"
   }
 }

src/validation/ValidationExecutor.ts

@@ -45,13 +45,14 @@ export class ValidationExecutor {
      */
     if (!this.metadataStorage.hasValidationMetaData && this.validatorOptions?.enableDebugMessages === true) {
       console.warn(
-        `No metadata found. There is more than once class-validator version installed probably. You need to flatten your dependencies.`
+        `No metadata found. There is more than one class-validator version installed probably. You need to flatten your dependencies.`
       );
     }
 
     const groups = this.validatorOptions ? this.validatorOptions.groups : undefined;
     const strictGroups = (this.validatorOptions && this.validatorOptions.strictGroups) || false;
     const always = (this.validatorOptions && this.validatorOptions.always) || false;
+    const forbidUnknownValues = this.validatorOptions?.forbidUnknownValues ?? true;
 
     const targetMetadatas = this.metadataStorage.getTargetValidationMetadatas(
       object.constructor,
@@ -62,7 +63,7 @@ export class ValidationExecutor {
     );
     const groupedMetadatas = this.metadataStorage.groupByPropertyName(targetMetadatas);
 
-    if (this.validatorOptions && this.validatorOptions.forbidUnknownValues && !targetMetadatas.length) {
+    if (forbidUnknownValues && !targetMetadatas.length) {
       const validationError = new ValidationError();
 
       if (

src/validation/ValidatorOptions.ts

@@ -72,7 +72,15 @@ export interface ValidatorOptions {
   };
 
   /**
-   * Settings true will cause fail validation of unknown objects.
+   * Setting this to false will allow unknown objects (i.e. objects whose prototype classes have no validation metadata) to pass validation.
+   * If you do not specify a value or you use null or undefined, a safe value of true will be used to prevent accidental validation bypass.
+   *
+   * For instance, since a plain empty object has no annotations used for validation:
+   * - `validate({}, { })` // fails
+   * - `validate({}, { forbidUnknownValues: true })` // fails
+   * - `validate({}, { forbidUnknownValues: false })` // passes
+   * - `validate(new SomeAnnotatedEmptyClass(), { forbidUnknownValues: true })` // passes
+   * - `validate(new SomeAnnotatedEmptyClass(), { })` // passes
    */
   forbidUnknownValues?: boolean;
 

test/functional/validation-functions-and-decorators.spec.ts

@@ -3662,15 +3662,15 @@ describe('Length', () => {
   });
 
   it('should return error object with proper data', () => {
-    const validationType = 'length';
+    const validationType = 'isLength';
     const message = 'someProperty must be longer than or equal to ' + constraintToString(constraint1) + ' characters';
-    checkReturnedError(new MyClass(), ['', 'a'], validationType, message);
+    return checkReturnedError(new MyClass(), ['', 'a'], validationType, message);
   });
 
   it('should return error object with proper data', () => {
-    const validationType = 'length';
+    const validationType = 'isLength';
     const message = 'someProperty must be shorter than or equal to ' + constraintToString(constraint2) + ' characters';
-    checkReturnedError(new MyClass(), ['aaaa', 'azzazza'], validationType, message);
+    return checkReturnedError(new MyClass(), ['aaaa', 'azzazza'], validationType, message);
   });
 });
 

test/functional/validation-options.spec.ts

@@ -946,28 +946,32 @@ describe('groups', () => {
     const model1 = new MyClass();
 
     it('should ignore decorators with groups if validating without groups', function () {
-      return validator.validate(model1, { strictGroups: true }).then(errors => {
+      return validator.validate(model1, { strictGroups: true, forbidUnknownValues: false }).then(errors => {
         expect(errors).toHaveLength(0);
       });
     });
 
     it('should ignore decorators with groups if validating with empty groups array', function () {
-      return validator.validate(model1, { strictGroups: true, groups: [] }).then(errors => {
+      return validator.validate(model1, { strictGroups: true, groups: [], forbidUnknownValues: false }).then(errors => {
         expect(errors).toHaveLength(0);
       });
     });
 
     it('should include decorators with groups if validating with matching groups', function () {
-      return validator.validate(model1, { strictGroups: true, groups: ['A'] }).then(errors => {
-        expect(errors).toHaveLength(1);
-        expectTitleContains(errors[0]);
-      });
+      return validator
+        .validate(model1, { strictGroups: true, groups: ['A'], forbidUnknownValues: false })
+        .then(errors => {
+          expect(errors).toHaveLength(1);
+          expectTitleContains(errors[0]);
+        });
     });
 
     it('should not include decorators with groups if validating with different groups', function () {
-      return validator.validate(model1, { strictGroups: true, groups: ['B'] }).then(errors => {
-        expect(errors).toHaveLength(0);
-      });
+      return validator
+        .validate(model1, { strictGroups: true, groups: ['B'], forbidUnknownValues: false })
+        .then(errors => {
+          expect(errors).toHaveLength(0);
+        });
     });
   });
 

test/functional/validator-options.spec.ts

@@ -24,10 +24,10 @@ describe('validator options', () => {
       });
   });
 
-  it('should returns error on unknown objects if forbidUnknownValues is true', function () {
+  test.each([[{ forbidUnknownValues: true }], [{}]])('should returns error on unknown objects with %s', options => {
     const anonymousObject = { badKey: 'This should not pass.' };
 
-    return validator.validate(anonymousObject, { forbidUnknownValues: true }).then(errors => {
+    return validator.validate(anonymousObject, { ...options }).then(errors => {
       expect(errors.length).toEqual(1);
       expect(errors[0].target).toEqual(anonymousObject);
       expect(errors[0].property).toEqual(undefined);

test/functional/whitelist-validation.spec.ts

@@ -52,12 +52,14 @@ describe('whitelist validation', () => {
 
     model.unallowedProperty = 'non-whitelisted';
 
-    return validator.validate(model, { whitelist: true, forbidNonWhitelisted: true }).then(errors => {
-      expect(errors.length).toEqual(1);
-      expect(errors[0].target).toEqual(model);
-      expect(errors[0].property).toEqual('unallowedProperty');
-      expect(errors[0].constraints).toHaveProperty(ValidationTypes.WHITELIST);
-      expect(() => errors[0].toString()).not.toThrowError();
-    });
+    return validator
+      .validate(model, { whitelist: true, forbidNonWhitelisted: true, forbidUnknownValues: false })
+      .then(errors => {
+        expect(errors.length).toEqual(1);
+        expect(errors[0].target).toEqual(model);
+        expect(errors[0].property).toEqual('unallowedProperty');
+        expect(errors[0].constraints).toHaveProperty(ValidationTypes.WHITELIST);
+        expect(() => errors[0].toString()).not.toThrowError();
+      });
   });
 });