Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Shape validation for input with a field named `constructor` will throw an error.

See original GitHub issue

Describe the bug Schema validation for any object shape throws an error if the input being validated contains a field named constructor.

To Reproduce

const yup = require("yup");
const schema = yup.object().shape({});                                                                                
schema.validate({ constructor: "bar" }).then(res => console.log(res));

Results in this trace:

/project/node_modules/yup/lib/object.js:155
        field = field.resolve(innerOptions);

TypeError: field.resolve is not a function
    at /project/node_modules/yup/lib/object.js:155:23
    at Array.forEach (<anonymous>)
    at ObjectSchema._cast (/project/node_modules/yup/lib/object.js:145:11)
    at ObjectSchema._validate (/project/node_modules/yup/lib/mixed.js:215:20)
    at ObjectSchema._validate (/project/node_modules/yup/lib/object.js:187:47)
    at ObjectSchema.validate (/project/node_modules/yup/lib/mixed.js:260:19)
    at Object.<anonymous> (/project/yup-error-demonstration.js:4:8)
    at Module._compile (internal/modules/cjs/loader.js:701:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:712:10)
    at Module.load (internal/modules/cjs/loader.js:600:32)

Expected behavior I expect constructor to not be considered a special field name for object validation.

Platform (please complete the following information):

Tested with node.js v10.15.3.

Additional context If the developer is using yup to validate form or query data on the backend the only way to mitigate this error is to sanitize the fields before sending them to yup. But a major feature of using yup is the noUnknown object to strip out unwanted fields, which cannot be relied upon if the input payload can be crafted to throw an error in yup.