highUser input reaching your database or shell

Request Bodies Not Validated or Whitelisted

Incoming request bodies are accepted as-is.

Why it matters

class-validator decorators on a DTO only run when a ValidationPipe is installed, and unknown properties are only removed when whitelist is on. Without both, a client can add fields the DTO never declared and they reach your database. Two options on one line fix it for every route.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

main.ts without a ValidationPipe
async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.enableCors();
  await app.listen(3000);
}
bootstrap();

The smallest fix

minimal patch
// main.ts
app.useGlobalPipes(new ValidationPipe({
  whitelist: true,              // strip properties the DTO does not declare
  forbidNonWhitelisted: true,   // or reject the request instead
  transform: true,
}));

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// Register it as a provider so tests and microservices get it too:
providers: [{ provide: APP_PIPE, useValue: new ValidationPipe({ whitelist: true, transform: true }) }]

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] request validation is missing or incomplete: [the flagged code]. Install a global ValidationPipe with whitelist: true and transform: true (forbidNonWhitelisted: true if the API should reject unknown fields), and make sure every @Body() parameter uses a DTO class with class-validator decorators.

How to check the fix worked

1. Send a request with an extra field such as "isAdmin": true and confirm
   it is stripped or rejected.
2. Send a body missing a required field and confirm a 400.

Further reading