@nestia/core 13.0.0 → 13.0.2

package/lib/decorators/EncryptedBody.js

@@ -58,7 +58,7 @@ function EncryptedBody(validator) {
                 ? param({ headers: headers.get(), body, direction: "decode" })
                 : param;
             // PARSE AND VALIDATE DATA
-            const data = JSON.parse(decrypt(body, password.key, password.iv));
+            const data = decode(body, password.key, password.iv);
             const error = checker(data);
             if (error !== null)
                 throw error;
@@ -66,10 +66,28 @@ function EncryptedBody(validator) {
         });
     })();
 }
-/** @internal */
-const decrypt = (body, key, iv) => {
+/**
+ * Decrypt and JSON-parse the request body behind a single failure response.
+ *
+ * `AesPkcs5` is AES-CBC without an authentication tag, so a MITM attacker can
+ * forge ciphertexts. Splitting the two failure modes of a forged body — a bad
+ * PKCS#5 padding (decryption throws) versus valid padding whose plaintext is
+ * not JSON (`JSON.parse` throws) — into two different HTTP status codes turns
+ * this decorator into a padding oracle: one observable bit per request lets the
+ * attacker recover the plaintext byte by byte without the key
+ * (GHSA-pqj4-gvf7-6fq5).
+ *
+ * Both failure modes must therefore collapse into one indistinguishable
+ * `BadRequestException` (identical status, message, and body). Only the
+ * downstream type validation of an already-parsed body may report its own
+ * distinct error, because reaching it requires plaintext the attacker cannot
+ * forge without already knowing it.
+ *
+ * @internal
+ */
+const decode = (body, key, iv) => {
     try {
-        return AesPkcs5_1.AesPkcs5.decrypt(body, key, iv);
+        return JSON.parse(AesPkcs5_1.AesPkcs5.decrypt(body, key, iv));
     }
     catch (exp) {
         if (exp instanceof Error)

package/lib/decorators/EncryptedBody.js.map

@@ -1 +1 @@
-{"version":3,"file":"EncryptedBody.js","sourceRoot":"","sources":["../../src/decorators/EncryptedBody.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,2DAAwD;AACxD,2CAIwB;AAKxB,kDAA+C;AAC/C,oEAAuE;AACvE,4DAAyD;AACzD,oEAAiE;AACjE,4DAAyD;AACzD,4EAAyE;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,uBACE,SAAoC;IAEpC,MAAM,OAAO,GAAG,IAAA,6CAAqB,EAAC,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC;IAClE,OAAO,IAAA,6BAAoB,EAAC,SAAe,aAAa,CACtD,QAAa,EACb,OAAyB;;YAEzB,MAAM,OAAO,GAAqC,OAAO;iBACtD,YAAY,EAAE;iBACd,UAAU,EAAE,CAAC;YAChB,IAAI,IAAA,6BAAa,EAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,KAAK,KAAK;gBACxE,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;YAE1E,MAAM,KAAK,GACT,OAAO,CAAC,WAAW,CAAC,2CAAuB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;YAEJ,gBAAgB;YAChB,MAAM,OAAO,GAAsC,IAAI,qBAAS,CAAC,GAAG,EAAE,CACpE,IAAA,qCAAiB,EAAC,OAAO,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,MAAM,IAAI,GAAW,MAAM,IAAA,6BAAa,EAAC,OAAO,CAAC,CAAC;YAClD,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,UAAU;gBACzB,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;gBAC9D,CAAC,CAAC,KAAK,CAAC;YAEZ,0BAA0B;YAC1B,MAAM,IAAI,GAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACvE,MAAM,KAAK,GAAiB,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,KAAK,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;KAAA,CAAC,EAAE,CAAC;AACP,CAAC;AAED,gBAAgB;AAChB,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAU,EAAU,EAAE;IAChE,IAAI,CAAC;QACH,OAAO,mBAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK;YACtB,MAAM,IAAI,4BAAmB,CAC3B,qFAAqF,CACtF,CAAC;;YACC,MAAM,GAAG,CAAC;IACjB,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"EncryptedBody.js","sourceRoot":"","sources":["../../src/decorators/EncryptedBody.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,2DAAwD;AACxD,2CAIwB;AAKxB,kDAA+C;AAC/C,oEAAuE;AACvE,4DAAyD;AACzD,oEAAiE;AACjE,4DAAyD;AACzD,4EAAyE;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,uBACE,SAAoC;IAEpC,MAAM,OAAO,GAAG,IAAA,6CAAqB,EAAC,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC;IAClE,OAAO,IAAA,6BAAoB,EAAC,SAAe,aAAa,CACtD,QAAa,EACb,OAAyB;;YAEzB,MAAM,OAAO,GAAqC,OAAO;iBACtD,YAAY,EAAE;iBACd,UAAU,EAAE,CAAC;YAChB,IAAI,IAAA,6BAAa,EAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,KAAK,KAAK;gBACxE,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;YAE1E,MAAM,KAAK,GACT,OAAO,CAAC,WAAW,CAAC,2CAAuB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;YAEJ,gBAAgB;YAChB,MAAM,OAAO,GAAsC,IAAI,qBAAS,CAAC,GAAG,EAAE,CACpE,IAAA,qCAAiB,EAAC,OAAO,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,MAAM,IAAI,GAAW,MAAM,IAAA,6BAAa,EAAC,OAAO,CAAC,CAAC;YAClD,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,UAAU;gBACzB,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;gBAC9D,CAAC,CAAC,KAAK,CAAC;YAEZ,0BAA0B;YAC1B,MAAM,IAAI,GAAQ,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAiB,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,KAAK,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;KAAA,CAAC,EAAE,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAU,EAAW,EAAE;IAChE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK;YACtB,MAAM,IAAI,4BAAmB,CAC3B,qFAAqF,CACtF,CAAC;;YACC,MAAM,GAAG,CAAC;IACjB,CAAC;AACH,CAAC,CAAC"}

package/native/transform/build.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"sync"
 	"time"
 
 	shimcompiler "github.com/microsoft/typescript-go/shim/compiler"
@@ -68,23 +69,54 @@ func runBuild(args []string) int {
 		return 2
 	}
 	if len(diags) > 0 {
+		if prog != nil {
+			prog.Close()
+		}
 		driver.WritePrettyDiagnostics(stderr, diags, cwd)
 		return 2
 	}
-	defer prog.Close()
-	releaseTypiaRegistries := registerTypiaDefaultLibraryClassifier(prog)
-	defer releaseTypiaRegistries()
 	if profile {
 		started = time.Now()
 	}
 	if diags := prog.Diagnostics(); len(diags) > 0 {
 		profileBuildStep(profile, "diagnostics", started)
+		prog.Close()
 		driver.WritePrettyDiagnostics(stderr, diags, cwd)
 		return 2
 	}
 	profileBuildStep(profile, "diagnostics", started)
 
 	shouldEmit := !prog.ParsedConfig.ParsedConfig.CompilerOptions.NoEmit.IsTrue()
+	if !shouldEmit {
+		// Plugin transformers are part of tsgo's emit pipeline. Reload with emit
+		// enabled so check/noEmit traverses the same source set, then discard every
+		// generated output below. The original program already proved the project's
+		// diagnostics; diagnosing this private reload would reject valid analysis-
+		// only options such as allowImportingTsExtensions.
+		prog.Close()
+		if profile {
+			started = time.Now()
+		}
+		prog, diags, err = driver.LoadProgram(cwd, *tsconfigPath, driver.LoadProgramOptions{
+			ForceEmit: true,
+			OutDir:    *outDir,
+		})
+		profileBuildStep(profile, "load-transform-program", started)
+		if err != nil {
+			fmt.Fprintf(stderr, "ttsc-nestia build: %v\n", err)
+			return 2
+		}
+		if len(diags) > 0 {
+			if prog != nil {
+				prog.Close()
+			}
+			driver.WritePrettyDiagnostics(stderr, diags, cwd)
+			return 2
+		}
+	}
+	defer prog.Close()
+	releaseTypiaRegistries := registerTypiaDefaultLibraryClassifier(prog)
+	defer releaseTypiaRegistries()
 	if !*quiet {
 		fmt.Fprintf(
 			stdout,
@@ -97,9 +129,6 @@ func runBuild(args []string) int {
 			shouldEmit,
 		)
 	}
-	if !shouldEmit {
-		return 0
-	}
 
 	// AST-integration emit: typia's per-file transformer and @nestia/core's own
 	// per-file transformer both run inside tsgo's emit pipeline (sharing the
@@ -132,10 +161,20 @@ func runBuild(args []string) int {
 	transforms := append([]driver.PluginTransform{typiaTransform, coreTransform}, contributorTransforms...)
 
 	emitted := []string{}
+	pending := []buildPendingOutput{}
+	var writeMu sync.Mutex
 	writeFile := shimcompiler.WriteFile(func(fileName, text string, data *shimcompiler.WriteFileData) error {
 		_ = data
-		emitted = append(emitted, fileName)
-		return driver.DefaultWriteFile(fileName, text)
+		if shouldEmit {
+			// TypeScript-Go emits declarations in parallel. Serialize the shared
+			// slices so buffering cannot lose an artifact or race while the
+			// declaration workers call this callback concurrently.
+			writeMu.Lock()
+			defer writeMu.Unlock()
+			emitted = append(emitted, fileName)
+			pending = append(pending, buildPendingOutput{FileName: fileName, Text: text})
+		}
+		return nil
 	})
 
 	// Declaration emit: ttsc delegates the whole emit of a transform-plugin
@@ -145,7 +184,7 @@ func runBuild(args []string) int {
 	// core runtime transforms never change the public type surface, so the
 	// declarations are taken from the pristine program — done before the JS
 	// transform runs so it reads the un-mutated AST.
-	if prog.ParsedConfig.ParsedConfig.CompilerOptions.Declaration.IsTrue() {
+	if shouldEmit && prog.ParsedConfig.ParsedConfig.CompilerOptions.Declaration.IsTrue() {
 		if profile {
 			started = time.Now()
 		}
@@ -162,10 +201,6 @@ func runBuild(args []string) int {
 		fmt.Fprintf(stderr, "ttsc-nestia build: emit failed: %v\n", err)
 		return 3
 	}
-	if len(transformDiags) > 0 {
-		WriteTypiaTransformDiagnostics(stderr, transformDiags, cwd)
-		return 3
-	}
 	emitHasError := false
 	for _, d := range eDiags {
 		fmt.Fprintln(stderr, "  -", d.String())
@@ -173,31 +208,48 @@ func runBuild(args []string) int {
 			emitHasError = true
 		}
 	}
+	if len(transformDiags) > 0 {
+		WriteTypiaTransformDiagnostics(stderr, transformDiags, cwd)
+		return 3
+	}
 	if emitHasError {
 		return 3
 	}
-	if *manifestPath != "" {
-		data, err := json.Marshal(emitted)
-		if err != nil {
-			fmt.Fprintf(stderr, "ttsc-nestia build: manifest marshal failed: %v\n", err)
-			return 3
+	if shouldEmit {
+		for _, output := range pending {
+			if err := driver.DefaultWriteFile(output.FileName, output.Text); err != nil {
+				fmt.Fprintf(stderr, "ttsc-nestia build: emit write failed: %v\n", err)
+				return 3
+			}
 		}
-		if err := os.MkdirAll(filepath.Dir(*manifestPath), 0o755); err != nil {
-			fmt.Fprintf(stderr, "ttsc-nestia build: manifest mkdir failed: %v\n", err)
-			return 3
+		if *manifestPath != "" {
+			data, err := json.Marshal(emitted)
+			if err != nil {
+				fmt.Fprintf(stderr, "ttsc-nestia build: manifest marshal failed: %v\n", err)
+				return 3
+			}
+			if err := os.MkdirAll(filepath.Dir(*manifestPath), 0o755); err != nil {
+				fmt.Fprintf(stderr, "ttsc-nestia build: manifest mkdir failed: %v\n", err)
+				return 3
+			}
+			if err := os.WriteFile(*manifestPath, data, 0o644); err != nil {
+				fmt.Fprintf(stderr, "ttsc-nestia build: manifest write failed: %v\n", err)
+				return 3
+			}
 		}
-		if err := os.WriteFile(*manifestPath, data, 0o644); err != nil {
-			fmt.Fprintf(stderr, "ttsc-nestia build: manifest write failed: %v\n", err)
-			return 3
+		if !*quiet {
+			fmt.Fprintf(stdout, "// ttsc-nestia build: emitted=%d files\n", len(emitted))
 		}
 	}
-	if !*quiet {
-		fmt.Fprintf(stdout, "// ttsc-nestia build: emitted=%d files\n", len(emitted))
-	}
 	profileBuildStep(profile, "total", totalStarted)
 	return 0
 }
 
+type buildPendingOutput struct {
+	FileName string
+	Text     string
+}
+
 // emitDeclarations runs tsgo's standard declaration emitter for the program.
 // tsgo's MarkLinkedReferences pass can nil-panic on some cross-module reference
 // shapes (e.g. a nestia.config.ts that calls NestFactory.create, compiled by the
@@ -220,39 +272,7 @@ func emitDeclarations(prog *driver.Program, writeFile shimcompiler.WriteFile) {
 }
 
 func runCheck(args []string) int {
-	fs := flag.NewFlagSet("check", flag.ContinueOnError)
-	fs.SetOutput(stderr)
-	tsconfigPath := fs.String("tsconfig", "tsconfig.json", "path to tsconfig.json")
-	cwdOverride := fs.String("cwd", "", "override the working directory")
-	pluginsJSON := fs.String("plugins-json", "", "ordered ttsc plugin payload")
-	if err := fs.Parse(args); err != nil {
-		return 2
-	}
-	if _, err := plugin.ParsePlan(*pluginsJSON); err != nil {
-		fmt.Fprintf(stderr, "ttsc-nestia check: %v\n", err)
-		return 2
-	}
-	cwd, ok := resolveCWD("ttsc-nestia check", *cwdOverride)
-	if !ok {
-		return 2
-	}
-	prog, diags, err := driver.LoadProgram(cwd, *tsconfigPath, driver.LoadProgramOptions{
-		ForceNoEmit: true,
-	})
-	if err != nil {
-		fmt.Fprintf(stderr, "ttsc-nestia check: %v\n", err)
-		return 2
-	}
-	if len(diags) > 0 {
-		driver.WritePrettyDiagnostics(stderr, diags, cwd)
-		return 2
-	}
-	defer prog.Close()
-	if diags := prog.Diagnostics(); len(diags) > 0 {
-		driver.WritePrettyDiagnostics(stderr, diags, cwd)
-		return 2
-	}
-	return 0
+	return runBuild(append([]string{"--noEmit"}, args...))
 }
 
 type Diagnostic struct {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestia/core",
-  "version": "13.0.0",
+  "version": "13.0.2",
   "description": "Super-fast validation decorators of NestJS",
   "main": "lib/index.js",
   "exports": {
@@ -45,8 +45,8 @@
   },
   "homepage": "https://nestia.io",
   "dependencies": {
-    "@typia/interface": "^14.0.1",
-    "@typia/utils": "^14.0.1",
+    "@typia/interface": "^14.0.2",
+    "@typia/utils": "^14.0.2",
     "get-function-location": "^2.0.0",
     "glob": "^11.0.3",
     "path-parser": "^6.1.0",
@@ -54,9 +54,9 @@
     "reflect-metadata": ">=0.1.12",
     "rxjs": ">=6.0.3",
     "tgrid": "^1.1.0",
-    "typia": "^14.0.1",
+    "typia": "^14.0.2",
     "ws": "^7.5.3",
-    "@nestia/fetcher": "^13.0.0"
+    "@nestia/fetcher": "^13.0.2"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.18.0",
@@ -65,8 +65,8 @@
     "reflect-metadata": ">=0.1.12",
     "rxjs": ">=6.0.3",
     "ttsc": ">=0.19.2",
-    "typia": "^14.0.1",
-    "@nestia/fetcher": "^13.0.0"
+    "typia": "^14.0.2",
+    "@nestia/fetcher": "^13.0.2"
   },
   "peerDependenciesMeta": {
     "@modelcontextprotocol/sdk": {

package/src/decorators/EncryptedBody.ts

@@ -69,17 +69,35 @@ export function EncryptedBody<T>(
         : param;
 
     // PARSE AND VALIDATE DATA
-    const data: any = JSON.parse(decrypt(body, password.key, password.iv));
+    const data: any = decode(body, password.key, password.iv);
     const error: Error | null = checker(data);
     if (error !== null) throw error;
     return data;
   })();
 }
 
-/** @internal */
-const decrypt = (body: string, key: string, iv: string): string => {
+/**
+ * Decrypt and JSON-parse the request body behind a single failure response.
+ *
+ * `AesPkcs5` is AES-CBC without an authentication tag, so a MITM attacker can
+ * forge ciphertexts. Splitting the two failure modes of a forged body — a bad
+ * PKCS#5 padding (decryption throws) versus valid padding whose plaintext is
+ * not JSON (`JSON.parse` throws) — into two different HTTP status codes turns
+ * this decorator into a padding oracle: one observable bit per request lets the
+ * attacker recover the plaintext byte by byte without the key
+ * (GHSA-pqj4-gvf7-6fq5).
+ *
+ * Both failure modes must therefore collapse into one indistinguishable
+ * `BadRequestException` (identical status, message, and body). Only the
+ * downstream type validation of an already-parsed body may report its own
+ * distinct error, because reaching it requires plaintext the attacker cannot
+ * forge without already knowing it.
+ *
+ * @internal
+ */
+const decode = (body: string, key: string, iv: string): unknown => {
   try {
-    return AesPkcs5.decrypt(body, key, iv);
+    return JSON.parse(AesPkcs5.decrypt(body, key, iv));
   } catch (exp) {
     if (exp instanceof Error)
       throw new BadRequestException(