TypeScript, Security, And Type Juggling With Ariel Shulman & Liran Tal

Player FM - Internet Radio Done Right

1,350 subscribers

הוסף לפני eight שנים

תוכן מסופק על ידי Charles M Wood. כל תוכן הפודקאסטים כולל פרקים, גרפיקה ותיאורי פודקאסטים מועלים ומסופקים ישירות על ידי Charles M Wood או שותף פלטפורמת הפודקאסט שלהם. אם אתה מאמין שמישהו משתמש ביצירה שלך המוגנת בזכויות יוצרים ללא רשותך, אתה יכול לעקוב אחר התהליך המתואר כאן https://he.player.fm/legal.

Crash Course DM

1
The Charcuterie Prose (The Lichual pt 1/2) 1:18:10

לפני 20 weeks1:18:10

הפעל מאוחר יותר

רשימות

לייק

אהבתי

1:18:10

Riddles, troikas, and food references abound! After a forbidden scroll is removed from the Arcane Library from the city of Eltin, a ragtag group of adventurers is dispatched to track it down. Join our party on their mysterious adventure, as Melony Melons tries to make friends, Agent Peaches searches for his next big story, Fromage passes some hot cheese samples to anyone who will listen, and Metzger Abbatoir tries to convince everyone he isn’t his father’s son. Starring: Nathan Zimmerer - Melony Melons Kyle Kane - Agent Peaches Shea Ingram - Metzger Abbatoir AKA Bouchet Chris Arr - Fromage Josh Greenway - The Dungeon Newbie Based on the Unraveled one-shot from Roll & Play Press https://rollandplaypress.com Edited by Josh Greenway Sound Effects provided by Pixabay.com Music Josh Greenway & Mark Canning Clavier Clavier ⁠https://pixabay.com/users/clavier-music-16027823⁠ Kellepics ⁠⁠Https://pixabay.com/users/kellepics-4893063…

JavaScript Jabber « »
TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

לפני 22 ימים 1:32:43

שתפו

MP3•בית הפרקים

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.
We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.
Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.
Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

740 פרקים