Whitelist and transform options in NestJS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the whitelist option do in NestJS validation?

The whitelist option removes any properties from the input object that are not explicitly defined in the DTO (Data Transfer Object). This helps keep only the allowed data and improves security.

beginner

What is the purpose of the transform option in NestJS validation pipe?

The transform option automatically converts input data types to the types defined in the DTO classes. For example, it can convert a string to a number if the DTO expects a number.

intermediate

How do whitelist and transform options work together in NestJS?

When both options are enabled, NestJS first removes unwanted properties (whitelist) and then converts the remaining data to the correct types (transform). This ensures clean and correctly typed input data.

beginner

How do you enable whitelist and transform options globally in a NestJS app?

You enable them by passing options to the ValidationPipe in the main app file, like this:

app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

intermediate

What happens if whitelist is false and extra properties are sent in a request?

If whitelist is false, extra properties not defined in the DTO remain in the input object. This can lead to unexpected data being processed or security risks.

What does setting whitelist: true in NestJS ValidationPipe do?

A Converts input data types automatically

B Allows all properties without filtering

C Disables validation

D Removes properties not in the DTO from the input

The whitelist option removes any properties not defined in the DTO, keeping only allowed data.

What is the effect of transform: true in NestJS ValidationPipe?

A Automatically converts input types to DTO types

B Blocks all invalid requests

C Removes extra properties

D Logs validation errors

Transform converts input data types to match the DTO class types automatically.

How do you enable both whitelist and transform globally in NestJS?

A app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }))

B app.useGlobalPipes(new ValidationPipe({ validate: true }))

C app.useGlobalPipes(new ValidationPipe({ sanitize: true }))

D app.useGlobalPipes(new ValidationPipe({ enable: true }))

You pass both options to ValidationPipe when setting it globally.

If whitelist is false, what happens to extra properties in the request?

A They cause an error

B They remain in the input object

C They are removed

D They are converted to null

Without whitelist, extra properties are not removed and stay in the input.

Why is using whitelist important for security?

A It disables validation

B It speeds up the app

C It prevents unwanted data from being processed

D It encrypts the data

Whitelist removes unexpected properties, reducing risk of malicious data.

Explain how the whitelist and transform options improve data handling in NestJS validation.

Think about filtering and converting input data.

Describe how to set up global validation in NestJS to use whitelist and transform options.

Look at the main app bootstrap file.

Practice

1. What does the whitelist option do when enabled in NestJS validation pipe?

easy

A. It disables validation for unknown properties.

B. It removes any properties not defined in the DTO from the input data.

C. It transforms input data types to match the DTO automatically.

D. It logs all incoming requests for debugging.

Solution

1. Step 1: Understand the whitelist option purpose

   The whitelist option removes any properties from the input that are not explicitly defined in the DTO (Data Transfer Object).

2. Step 2: Compare with other options

   Transform changes types, logging is unrelated, and disabling validation is not whitelist's role.

3. Final Answer:

   It removes any properties not defined in the DTO from the input data. -> Option B

4. Quick Check:

   Whitelist = remove extra fields [OK]

Hint: Whitelist = remove unwanted fields from input [OK]

Common Mistakes:

• Confusing whitelist with transform option
• Thinking whitelist disables validation
• Assuming whitelist logs data

2. Which is the correct way to enable both whitelist and transform options in a global validation pipe in NestJS?

easy

A. app.useGlobalPipes(new ValidationPipe({ whitelist: false, transform: true }));

B. app.useGlobalPipes(new ValidationPipe(whitelist: true, transform: true));

C. app.useGlobalPipes(new ValidationPipe({ whitelist: 'true', transform: 'true' }));

D. app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

Solution

1. Step 1: Check the syntax for ValidationPipe options

   Options must be passed as an object with keys and boolean values inside curly braces.

2. Step 2: Validate option values

   Both whitelist and transform must be boolean true, not strings or missing braces.

3. Final Answer:

   app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true })); -> Option D

4. Quick Check:

   Correct object syntax with booleans [OK]

Hint: Use object with booleans inside braces for options [OK]

Common Mistakes:

• Missing curly braces around options
• Using strings instead of booleans
• Setting whitelist to false by mistake

3. Given this DTO and input, what will be the output after validation with whitelist: true and transform: true?

class UserDto {
  name: string;
  age: number;
}

const input = { name: 'Alice', age: '30', extra: 'remove me' };

medium

A. { name: 'Alice', age: 30 }

B. { name: 'Alice', age: '30', extra: 'remove me' }

C. { name: 'Alice', age: 30, extra: 'remove me' }

D. Validation error due to extra property

Solution

1. Step 1: Apply whitelist option

   The extra property 'extra' is removed because whitelist is true.

2. Step 2: Apply transform option

   The age string '30' is converted to number 30 as per DTO type.

3. Final Answer:

   { name: 'Alice', age: 30 } -> Option A

4. Quick Check:

   Whitelist removes extra, transform converts types [OK]

Hint: Whitelist removes extras; transform converts types [OK]

Common Mistakes:

• Expecting extra fields to remain
• Not realizing transform converts string to number
• Thinking validation fails on extra fields with whitelist

4. You set whitelist: true but forgot transform: true in your ValidationPipe. What issue might you face when receiving input with number fields as strings?

medium

A. Input number fields remain strings, causing type errors later.

B. Extra fields are not removed from input.

C. ValidationPipe throws a syntax error.

D. Input is automatically converted to correct types.

Solution

1. Step 1: Understand whitelist without transform

   Whitelist removes extra fields but does not convert types.

2. Step 2: Consequence of missing transform

   Number fields sent as strings remain strings, which can cause errors in code expecting numbers.

3. Final Answer:

   Input number fields remain strings, causing type errors later. -> Option A

4. Quick Check:

   Missing transform = no type conversion [OK]

Hint: Whitelist only removes fields; transform converts types [OK]

Common Mistakes:

• Assuming whitelist converts types
• Expecting syntax errors from missing transform
• Thinking extra fields remain with whitelist true

5. You want to accept a nested object in your DTO and ensure unwanted fields are removed and types are converted. Which ValidationPipe options setup correctly handles nested objects with whitelist and transform?

hard

A. new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true })

B. new ValidationPipe({ whitelist: false, transform: true, transformOptions: { enableImplicitConversion: false } })

C. new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } })

D. new ValidationPipe({ whitelist: true, transform: false, forbidNonWhitelisted: true })

Solution

1. Step 1: Recognize nested object handling needs transform options

   For nested objects, enabling implicit conversion helps transform nested types correctly.

2. Step 2: Check options for whitelist and transform

   Whitelist true removes unwanted fields; transform true with transformOptions enables nested conversion.

3. Step 3: Compare other options

   Options with forbidNonWhitelisted: true throw errors on extras instead of removing; others disable whitelist or transform or lack transformOptions.

4. Final Answer:

   new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } }) -> Option C

5. Quick Check:

   whitelist + transform + enableImplicitConversion [OK]

Hint: Use transformOptions with enableImplicitConversion for nested objects [OK]

Common Mistakes:

• Ignoring transformOptions for nested conversion
• Disabling transform but expecting type conversion
• Not using whitelist to remove extra nested fields