mediumUser input reaching your database or shell

Request Body Accepted Without a DTO

A handler takes the raw request body with no declared shape.

Why it matters

A DTO class with class-validator decorators is what tells NestJS which fields are allowed and what they must look like. Typed as any, the ValidationPipe has nothing to check and the handler trusts whatever arrives. Writing the DTO also documents the endpoint for free.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Body typed as any
@Post()
create(@Body() body: any) {
  return this.posts.create(body);
}

The smallest fix

minimal patch
export class CreatePostDto {
  @IsString() @MaxLength(200) title: string;
  @IsString() body: string;
}

@Post()
create(@Body() dto: CreatePostDto) { ... }

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// With nestjs-zod, define the schema once and derive both the DTO class
// and the TypeScript type from it.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] a request body is untyped: [the flagged code]. Create a DTO class with class-validator decorators for exactly the fields the client may send, type the parameter with it, and make sure a global ValidationPipe with whitelist: true is installed.

How to check the fix worked

1. Send a body with an unexpected field and confirm it is stripped or
   rejected.
2. Send a body with a wrong type for a field and confirm a 400.

Further reading