Friend or Foe? TypeScript Security Fallacies
summary
TypeScript gives compile‑time safety but not runtime guarantees: an Express + TypeScript demo app shows how HTTP parameter pollution lets arrays masquerade as strings, how a real template‑engine bug found by fuzzing netted a $10,000 bounty, and how prototype pollution and mass‑assignment can bypass schemas so Zod bypass is practical unless code explicitly rejects magic keys; the demos run end‑to‑end, the vulnerable patterns reproduce, and a Sneak extension flags some of the unsafe cases.
AI-written summary · about
chapters (19)
- 0:00TypeScript security concerns
- 1:03Types and security pitfalls
- 3:51False trust in TypeScript
- 7:05HTTP parameter pollution
- 9:34False security in apps
- 11:43Bypass type juggling
- 13:50String typing fails
- 15:36Secure typing with interfaces
- 17:00XSS and sanitization bypass
- 19:45TypeScript not a security tool
- 21:08TypeScript narrowing limits
- 22:34ZOD for schema enforcement
- 23:16Bypass prototype pollution
- 26:07Prototype pollution attacks
- 31:23Bypass mass assignment
- 34:58Library vulnerabilities and fixes
- 37:45Case study: doT.js engine
- 39:31Key takeaways
- 40:56Demo and resources
related talks
22mThink you know TypeScript? Think again.
21mThe long-tail of type safety
35mSafeguarding Large-Scale Projects: Navigating TypeScript Security Pitfalls
21mBeyond Type Checking Building Bulletproof TypseScript Applications
21mThe long-tail of type safety
34mReal World JavaScript Security
31mLies We Tell Ourselves Using TypeScript v2
29mThe Lies we Tell Ourselves using TypeScript