Skip to content

fix(common): reject null file input in ParseFilePipe - #17598

Merged
kamilmysliwiec merged 1 commit into
nestjs:masterfrom
koreahghg:fix/parse-file-pipe-null-value
Aug 28, 2026
Merged

kamilmysliwiec merged 1 commit into
nestjs:masterfrom
koreahghg:fix/parse-file-pipe-null-value

Conversation

@koreahghg

Copy link
Copy Markdown
Contributor

PR Checklist

  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been added / updated (for bug fixes / features)

PR Type

  • Bugfix
  • Feature
  • Code style update (formatting, local variables)
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • CI related changes
  • Documentation content changes
  • Other

What is the current behavior?

ParseFilePipe.thereAreNoFilesIn() only checks for undefined via isUndefined(). When the value is null instead, it's treated as if a file were present:

  • The fileIsRequired check is skipped, even though fileIsRequired defaults to true.
  • Any registered validator that already treats a falsy file as trivially valid (e.g. MaxFileSizeValidator.isValid() returns true when !file) also silently passes.

As a result, new ParseFilePipe().transform(null) resolves to null instead of throwing, and the failure only surfaces later as a TypeError when the handler dereferences the file.

What is the new behavior?

thereAreNoFilesIn() now uses isNil() instead of isUndefined(), so null and undefined are handled identically — both correctly trigger the "File is required" exception (or the registered validators, if fileIsRequired is false).

Two regression tests were added:

  • null with fileIsRequired: true now throws BadRequestException.
  • null with a validator that mimics the built-in "skip validation when no file" behavior (like MaxFileSizeValidator) now still throws, instead of silently passing.

Does this PR introduce a breaking change?

  • Yes
  • No

null was never valid/expected input for a required file parameter; this only makes the pipe reject it explicitly instead of silently letting it through.

ParseFilePipe.thereAreNoFilesIn() only checked for `undefined` via
isUndefined(), so a `null` value was treated as "a file is present".
This let `null` bypass the fileIsRequired check, and skip validators
that already treat a falsy file as trivially valid (e.g.
MaxFileSizeValidator returns true when `!file`), silently letting a
required file argument resolve to `null` instead of throwing.

Switch to isNil() so `null` and `undefined` are handled the same way.
@kamilmysliwiec
kamilmysliwiec merged commit f216411 into nestjs:master Aug 28, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants