Whitelist and transform options in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the effect of enabling whitelist in NestJS ValidationPipe?

Consider a NestJS controller using ValidationPipe with whitelist: true. What happens to extra properties sent in the request body that are not defined in the DTO?

NestJS

import { Controller, Post, Body, ValidationPipe } from '@nestjs/common';
import { IsString } from 'class-validator';

class CreateUserDto {
  @IsString()
  name: string;
}

@Controller('users')
export class UsersController {
  @Post()
  create(
    @Body(new ValidationPipe({ whitelist: true })) createUserDto: CreateUserDto
  ) {
    return createUserDto;
  }
}

A Extra properties are removed from the request body before validation and controller logic.

B Extra properties cause the validation to fail with an error.

C Extra properties are kept and passed to the controller as-is.

D Extra properties are logged but still passed to the controller.

💡 Hint

Think about what whitelist means in the context of filtering properties.

When whitelist: true is set, NestJS automatically removes any properties not defined in the DTO before passing the data to the controller. This helps keep the input clean and secure.

❓ state_output

intermediate

What is the output of this NestJS controller with transform: true enabled?

Given the following DTO and controller, what will be the type of age inside the create method?

NestJS

import { Controller, Post, Body, ValidationPipe } from '@nestjs/common';
import { IsInt } from 'class-validator';

class CreateUserDto {
  @IsInt()
  age: number;
}

@Controller('users')
export class UsersController {
  @Post()
  create(
    @Body(new ValidationPipe({ transform: true })) createUserDto: CreateUserDto
  ) {
    return typeof createUserDto.age;
  }
}

A "string" because request body values are strings by default.

B "undefined" because age is not set correctly.

C "number" because transform converts input to the DTO types.

D "object" because DTO instances are plain objects.

💡 Hint

Consider what transform: true does to incoming data types.

With transform: true, NestJS converts the incoming JSON strings to the types defined in the DTO, so age becomes a number instead of a string.

📝 Syntax

advanced

Which option correctly enables both whitelist and transform globally in a NestJS app?

Choose the correct way to apply ValidationPipe globally with whitelist and transform enabled.

NestJS

import { ValidationPipe } from '@nestjs/common';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  // Apply global pipe here
  await app.listen(3000);
}
bootstrap();

A app.useGlobalPipes(new ValidationPipe({ whitelist: 'true', transform: 'true' }));

B app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

C app.useGlobalPipes(new ValidationPipe[whitelist: true, transform: true]);

D app.useGlobalPipes(ValidationPipe({ whitelist: true, transform: true }));

💡 Hint

Remember how to instantiate classes and pass options as an object.

The correct syntax uses new ValidationPipe with an object containing boolean options. Option B misses new, C uses wrong brackets, and A passes strings instead of booleans.

🔧 Debug

advanced

Why does this NestJS ValidationPipe not remove extra properties despite whitelist: true?

Examine the code below. The controller expects whitelist: true to remove extra properties, but they remain. What is the cause?

NestJS

import { Controller, Post, Body, ValidationPipe } from '@nestjs/common';
import { IsString } from 'class-validator';

class CreateUserDto {
  @IsString()
  username: string;
}

@Controller('users')
export class UsersController {
  @Post()
  create(
    @Body(new ValidationPipe({ whitelist: true, skipMissingProperties: true })) createUserDto: CreateUserDto
  ) {
    return createUserDto;
  }
}

A The <code>skipMissingProperties</code> option disables <code>whitelist</code> filtering.

B The DTO class is missing <code>@Type()</code> decorator to enable transformation.

C The <code>ValidationPipe</code> must be applied globally to work properly.

D The extra properties are not removed because <code>forbidNonWhitelisted</code> is not set.

💡 Hint

Check how skipMissingProperties affects validation behavior.

When skipMissingProperties is true, whitelist does not remove extra properties because validation skips missing fields, affecting the filtering process.

🧠 Conceptual

expert

What is the combined effect of whitelist: true and forbidNonWhitelisted: true in NestJS ValidationPipe?

When both whitelist and forbidNonWhitelisted are set to true, what happens if the request body contains extra properties not in the DTO?

A The request proceeds but the extra properties are converted to null.

B The extra properties are removed silently and the request proceeds.

C The extra properties are kept but logged as warnings.

D The request fails validation and an error is thrown for extra properties.

💡 Hint

Consider what forbidNonWhitelisted adds on top of whitelist.

Setting forbidNonWhitelisted: true causes the validation to reject requests containing properties not in the DTO, throwing an error instead of silently removing them.