Add a fix for the vulnerability in zod literal validation message, wh…

…ich was exposing sensitive information in error message.
colinhacks · Nov 12, 2024 · d4eea3b · d4eea3b
1 parent f487d74
commit d4eea3b
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 20 deletions.
diff --git a/deno/lib/__tests__/error.test.ts b/deno/lib/__tests__/error.test.ts
@@ -498,9 +498,7 @@ test("literal default error message", () => {
   } catch (err) {
     const zerr: z.ZodError = err as any;
     expect(zerr.issues.length).toEqual(1);
-    expect(zerr.issues[0].message).toEqual(
-      `Invalid literal value, expected "Tuna"`
-    );
+    expect(zerr.issues[0].message).toEqual(`Invalid literal value`);
   }
 });
 
@@ -510,9 +508,7 @@ test("literal bigint default error message", () => {
   } catch (err) {
     const zerr: z.ZodError = err as any;
     expect(zerr.issues.length).toEqual(1);
-    expect(zerr.issues[0].message).toEqual(
-      `Invalid literal value, expected "12"`
-    );
+    expect(zerr.issues[0].message).toEqual(`Invalid literal value`);
   }
 });
 

diff --git a/deno/lib/locales/en.ts b/deno/lib/locales/en.ts
@@ -12,10 +12,7 @@ const errorMap: ZodErrorMap = (issue, _ctx) => {
       }
       break;
     case ZodIssueCode.invalid_literal:
-      message = `Invalid literal value, expected ${JSON.stringify(
-        issue.expected,
-        util.jsonStringifyReplacer
-      )}`;
+      message = `Invalid literal value`;
       break;
     case ZodIssueCode.unrecognized_keys:
       message = `Unrecognized key(s) in object: ${util.joinValues(

diff --git a/src/__tests__/error.test.ts b/src/__tests__/error.test.ts
@@ -497,9 +497,7 @@ test("literal default error message", () => {
   } catch (err) {
     const zerr: z.ZodError = err as any;
     expect(zerr.issues.length).toEqual(1);
-    expect(zerr.issues[0].message).toEqual(
-      `Invalid literal value, expected "Tuna"`
-    );
+    expect(zerr.issues[0].message).toEqual(`Invalid literal value`);
   }
 });
 
@@ -509,9 +507,7 @@ test("literal bigint default error message", () => {
   } catch (err) {
     const zerr: z.ZodError = err as any;
     expect(zerr.issues.length).toEqual(1);
-    expect(zerr.issues[0].message).toEqual(
-      `Invalid literal value, expected "12"`
-    );
+    expect(zerr.issues[0].message).toEqual(`Invalid literal value`);
   }
 });
 

diff --git a/src/locales/en.ts b/src/locales/en.ts
@@ -12,10 +12,7 @@ const errorMap: ZodErrorMap = (issue, _ctx) => {
       }
       break;
     case ZodIssueCode.invalid_literal:
-      message = `Invalid literal value, expected ${JSON.stringify(
-        issue.expected,
-        util.jsonStringifyReplacer
-      )}`;
+      message = `Invalid literal value`;
       break;
     case ZodIssueCode.unrecognized_keys:
       message = `Unrecognized key(s) in object: ${util.joinValues(