Whitelist and transform options in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the effect of enabling whitelist in NestJS ValidationPipe?

Consider a NestJS controller using ValidationPipe with whitelist: true. What happens to extra properties sent in the request body that are not defined in the DTO?

NestJS

import { Controller, Post, Body, ValidationPipe } from '@nestjs/common';
import { IsString } from 'class-validator';

class CreateUserDto {
  @IsString()
  name: string;
}

@Controller('users')
export class UsersController {
  @Post()
  create(
    @Body(new ValidationPipe({ whitelist: true })) createUserDto: CreateUserDto
  ) {
    return createUserDto;
  }
}

A Extra properties are removed from the request body before validation and controller logic.

B Extra properties cause the validation to fail with an error.

C Extra properties are kept and passed to the controller as-is.

D Extra properties are logged but still passed to the controller.

💡 Hint

Think about what whitelist means in the context of filtering properties.

When whitelist: true is set, NestJS automatically removes any properties not defined in the DTO before passing the data to the controller. This helps keep the input clean and secure.

❓ state_output

intermediate

What is the output of this NestJS controller with transform: true enabled?

Given the following DTO and controller, what will be the type of age inside the create method?

NestJS

import { Controller, Post, Body, ValidationPipe } from '@nestjs/common';
import { IsInt } from 'class-validator';

class CreateUserDto {
  @IsInt()
  age: number;
}

@Controller('users')
export class UsersController {
  @Post()
  create(
    @Body(new ValidationPipe({ transform: true })) createUserDto: CreateUserDto
  ) {
    return typeof createUserDto.age;
  }
}

A "string" because request body values are strings by default.

B "undefined" because age is not set correctly.

C "number" because transform converts input to the DTO types.

D "object" because DTO instances are plain objects.

💡 Hint

Consider what transform: true does to incoming data types.

With transform: true, NestJS converts the incoming JSON strings to the types defined in the DTO, so age becomes a number instead of a string.

📝 Syntax

advanced

Which option correctly enables both whitelist and transform globally in a NestJS app?

Choose the correct way to apply ValidationPipe globally with whitelist and transform enabled.

NestJS

import { ValidationPipe } from '@nestjs/common';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  // Apply global pipe here
  await app.listen(3000);
}
bootstrap();

A app.useGlobalPipes(new ValidationPipe({ whitelist: 'true', transform: 'true' }));

B app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

C app.useGlobalPipes(new ValidationPipe[whitelist: true, transform: true]);

D app.useGlobalPipes(ValidationPipe({ whitelist: true, transform: true }));

💡 Hint

Remember how to instantiate classes and pass options as an object.

The correct syntax uses new ValidationPipe with an object containing boolean options. Option B misses new, C uses wrong brackets, and A passes strings instead of booleans.

🔧 Debug

advanced

Why does this NestJS ValidationPipe not remove extra properties despite whitelist: true?

Examine the code below. The controller expects whitelist: true to remove extra properties, but they remain. What is the cause?

NestJS

import { Controller, Post, Body, ValidationPipe } from '@nestjs/common';
import { IsString } from 'class-validator';

class CreateUserDto {
  @IsString()
  username: string;
}

@Controller('users')
export class UsersController {
  @Post()
  create(
    @Body(new ValidationPipe({ whitelist: true, skipMissingProperties: true })) createUserDto: CreateUserDto
  ) {
    return createUserDto;
  }
}

A The <code>skipMissingProperties</code> option disables <code>whitelist</code> filtering.

B The DTO class is missing <code>@Type()</code> decorator to enable transformation.

C The <code>ValidationPipe</code> must be applied globally to work properly.

D The extra properties are not removed because <code>forbidNonWhitelisted</code> is not set.

💡 Hint

Check how skipMissingProperties affects validation behavior.

When skipMissingProperties is true, whitelist does not remove extra properties because validation skips missing fields, affecting the filtering process.

🧠 Conceptual

expert

What is the combined effect of whitelist: true and forbidNonWhitelisted: true in NestJS ValidationPipe?

When both whitelist and forbidNonWhitelisted are set to true, what happens if the request body contains extra properties not in the DTO?

A The request proceeds but the extra properties are converted to null.

B The extra properties are removed silently and the request proceeds.

C The extra properties are kept but logged as warnings.

D The request fails validation and an error is thrown for extra properties.

💡 Hint

Consider what forbidNonWhitelisted adds on top of whitelist.

Setting forbidNonWhitelisted: true causes the validation to reject requests containing properties not in the DTO, throwing an error instead of silently removing them.

Practice

1. What does the whitelist option do when enabled in NestJS validation pipe?

easy

A. It disables validation for unknown properties.

B. It removes any properties not defined in the DTO from the input data.

C. It transforms input data types to match the DTO automatically.

D. It logs all incoming requests for debugging.

Solution

1. Step 1: Understand the whitelist option purpose

   The whitelist option removes any properties from the input that are not explicitly defined in the DTO (Data Transfer Object).

2. Step 2: Compare with other options

   Transform changes types, logging is unrelated, and disabling validation is not whitelist's role.

3. Final Answer:

   It removes any properties not defined in the DTO from the input data. -> Option B

4. Quick Check:

   Whitelist = remove extra fields [OK]

Hint: Whitelist = remove unwanted fields from input [OK]

Common Mistakes:

• Confusing whitelist with transform option
• Thinking whitelist disables validation
• Assuming whitelist logs data

2. Which is the correct way to enable both whitelist and transform options in a global validation pipe in NestJS?

easy

A. app.useGlobalPipes(new ValidationPipe({ whitelist: false, transform: true }));

B. app.useGlobalPipes(new ValidationPipe(whitelist: true, transform: true));

C. app.useGlobalPipes(new ValidationPipe({ whitelist: 'true', transform: 'true' }));

D. app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

Solution

1. Step 1: Check the syntax for ValidationPipe options

   Options must be passed as an object with keys and boolean values inside curly braces.

2. Step 2: Validate option values

   Both whitelist and transform must be boolean true, not strings or missing braces.

3. Final Answer:

   app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true })); -> Option D

4. Quick Check:

   Correct object syntax with booleans [OK]

Hint: Use object with booleans inside braces for options [OK]

Common Mistakes:

• Missing curly braces around options
• Using strings instead of booleans
• Setting whitelist to false by mistake

3. Given this DTO and input, what will be the output after validation with whitelist: true and transform: true?

class UserDto {
  name: string;
  age: number;
}

const input = { name: 'Alice', age: '30', extra: 'remove me' };

medium

A. { name: 'Alice', age: 30 }

B. { name: 'Alice', age: '30', extra: 'remove me' }

C. { name: 'Alice', age: 30, extra: 'remove me' }

D. Validation error due to extra property

Solution

1. Step 1: Apply whitelist option

   The extra property 'extra' is removed because whitelist is true.

2. Step 2: Apply transform option

   The age string '30' is converted to number 30 as per DTO type.

3. Final Answer:

   { name: 'Alice', age: 30 } -> Option A

4. Quick Check:

   Whitelist removes extra, transform converts types [OK]

Hint: Whitelist removes extras; transform converts types [OK]

Common Mistakes:

• Expecting extra fields to remain
• Not realizing transform converts string to number
• Thinking validation fails on extra fields with whitelist

4. You set whitelist: true but forgot transform: true in your ValidationPipe. What issue might you face when receiving input with number fields as strings?

medium

A. Input number fields remain strings, causing type errors later.

B. Extra fields are not removed from input.

C. ValidationPipe throws a syntax error.

D. Input is automatically converted to correct types.

Solution

1. Step 1: Understand whitelist without transform

   Whitelist removes extra fields but does not convert types.

2. Step 2: Consequence of missing transform

   Number fields sent as strings remain strings, which can cause errors in code expecting numbers.

3. Final Answer:

   Input number fields remain strings, causing type errors later. -> Option A

4. Quick Check:

   Missing transform = no type conversion [OK]

Hint: Whitelist only removes fields; transform converts types [OK]

Common Mistakes:

• Assuming whitelist converts types
• Expecting syntax errors from missing transform
• Thinking extra fields remain with whitelist true

5. You want to accept a nested object in your DTO and ensure unwanted fields are removed and types are converted. Which ValidationPipe options setup correctly handles nested objects with whitelist and transform?

hard

A. new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true })

B. new ValidationPipe({ whitelist: false, transform: true, transformOptions: { enableImplicitConversion: false } })

C. new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } })

D. new ValidationPipe({ whitelist: true, transform: false, forbidNonWhitelisted: true })

Solution

1. Step 1: Recognize nested object handling needs transform options

   For nested objects, enabling implicit conversion helps transform nested types correctly.

2. Step 2: Check options for whitelist and transform

   Whitelist true removes unwanted fields; transform true with transformOptions enables nested conversion.

3. Step 3: Compare other options

   Options with forbidNonWhitelisted: true throw errors on extras instead of removing; others disable whitelist or transform or lack transformOptions.

4. Final Answer:

   new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } }) -> Option C

5. Quick Check:

   whitelist + transform + enableImplicitConversion [OK]

Hint: Use transformOptions with enableImplicitConversion for nested objects [OK]

Common Mistakes:

• Ignoring transformOptions for nested conversion
• Disabling transform but expecting type conversion
• Not using whitelist to remove extra nested fields