Typescript Application Security from A to Z: A Guide to Protecting Against Obvious and Not-So-Obvious Vulnerabilities

ject(dto);

const users = await userRepository.find({ order: { [dto.sortColumn]: dto.order }, }); });

**Partial Raw Query Vulnerability:**  

app.get('/search', async (req, res) => { const { q } = req.query;

const users = await userRepository.find({ where: { name: Raw(alias => ${alias} LIKE '%${q}%') } }); res.json(users); });

**Parameterized Placeholder Fix:**  

where: { name: Raw(alias => ${alias} ILIKE :query, { query: %${q}% }) }

**QueryBuilder String Interpolation Risk:**  

app.get('/users', async (req, res) => { const { filter } = req.query; // filter = "admin'; DROP TABLE users; --" const qb = userRepository.createQueryBuilder('user'); if (filter) { qb.where(user.role = '${filter}'); } const users = await qb.getMany(); res.json(users); });

**Safer QueryBuilder Alternative:**  

if (filter) { qb.where('user.role = :role', { role: filter }); }

### 2. NoSQL Injection Prevention (Mongoose)
Direct object passing from `req.body` to Mongoose queries allows operator injection. Runtime type narrowing and schema validation block malicious payloads.

**Vulnerable Code:**  

app.post('/login', async (req, res) => { const { username, password } = req.body; // req.body can contain: { username: { $ne: null }, password: { $ne: null } } const user = await UserModel.findOne({ username, password }).exec(); if (user) { res.json({ token: generateToken(user) }); } else { res.status(401).send(); } });

**Manual Sanitization Function:**  

function sanitizeInput(obj: Record<string, unknown>): Record<string, string> { const clean: Record<string, string> = {}; for (const [key, value] of Object.entries(obj)) { if (typeof value !== 'string') { throw new Error('Invalid input type'); } clean[key] = value; } return clean; }

### 3. Prototype Pollution Defense
Recursive merges on untrusted input mutate `Object.prototype`. Schema-first parsing with Zod automatically strips undeclared keys including `__proto__` and `constructor`.

**Dangerous Deep Merge:**  

// Danger function function deepMerge(target: any, source: any) { for (const key in source) { if (typeof source[key] === 'object' && source[key] !== null) { if (!target[key]) target[key] = {}; deepMerge(target[key], source[key]); } else { target[key] = source[key]; } } }

app.put('/settings', (req, res) => { const userSettings = JSON.parse(fs.readFileSync('settings.json', 'utf-8')); // Danger deepMerge(userSettings, req.body); fs.writeFileSync('settings.json', JSON.stringify(userSettings)); res.send('ok'); });

**Zod Schema Enforcement:**  

import { z } from 'zod';

const SettingsSchema = z.object({ theme: z.enum(['light', 'dark']), notifications: z.boolean(), });

app.put('/settings', (req, res) => { const parsed = SettingsSchema.safeParse(req.body); if (!parsed.success) { return res.status(400).json({ errors: parsed.error }); }

// Work only with parsed.data });

### 4. JWT & Secrets Management
Algorithm confusion and missing verification constraints enable token forgery. Environment validation prevents secret leakage and startup failures.

**Algorithm Validation Fix:**  

const decoded = jwt.verify(token, config.publicKey, { algorithms: ['RS256'], // or ['ES256'] });

**Environment Schema Validation:**  

const envSchema = z.object({ JWT_SECRET: z.string().min(32), DB_URL: z.string().url(), }); const env = envSchema.parse(process.env);

### 5. SSTI Mitigation (Template Engines)
When outsourcing HTML rendering to server-side engines, always enforce auto-escaping, use context-aware encoding, and never inject raw user input into template contexts. Validate and sanitize data before passing to rendering pipelines.

## Pitfall Guide
1. **TypeScript Types as Security Boundaries**: Interfaces and type aliases are erased at runtime. They do not filter, sanitize, or validate HTTP payloads. Relying on them for security leaves injection vectors completely open.
2. **Raw String Interpolation in ORMs**: Using template literals or string concatenation inside `Raw()`, `.where()`, or query builders bypasses parameterization. Always use named placeholders (`:param`) or ORM-safe query methods.
3. **Unsanitized Object Injection in NoSQL**: Passing `req.body` directly to Mongoose/Prisma queries allows attackers to inject MongoDB operators (`$ne`, `$gt`, `$regex`). Enforce strict DTO schemas that reject non-primitive types.
4. **Missing JWT Algorithm Constraints**: Omitting the `algorithms` array in `jwt.verify()` enables `none` algorithm bypasses and HMAC/RS256 confusion attacks. Always explicitly whitelist expected signing algorithms.
5. **Unsafe Deep Merging of User Input**: Recursive object assignment or `lodash.merge` on untrusted payloads can pollute `Object.prototype`. Use schema validation to strip undeclared keys before any merge operation.
6. **Hardcoded Secrets & Missing Env Validation**: Committing `.env` files or skipping startup validation causes credential exposure and silent runtime failures. Validate all environment variables against a strict schema before application bootstrap.

## Deliverables
- **TypeScript Security Architecture Blueprint**: A reference architecture mapping validation middleware placement, schema-first boundary enforcement, parameterized data access layers, and secure JWT/session configuration patterns for Node.js/Express/Fastify/NestJS stacks.
- **Pre-Deployment Security Checklist**: A 24-point verification matrix covering input validation coverage, ORM query parameterization, JWT algorithm whitelisting, environment variable validation, prototype pollution safeguards, and template engine auto-escaping compliance.
- **Configuration Templates**: Production-ready Zod schemas for environment validation, `class-validator` DTO templates for query/body parsing, JWT verification configuration snippets, and safe deep-merge alternatives with schema stripping.