Insufficient validation and cleaning of objects in arrays and of null values

I stumbled across this because of the recent AutoForm bug where null entries are left in arrays:

Test case:

var arraySchema = new SimpleSchema({
    names: { type: [String] },
    testField: { type: String, optional: true }
});
var validObject = { names: ["String"] };
var validEmptyObject = { names: [] };
var invalidObject = { names: [{hello:"world"}] };
var certainlyInvalidObject = { zebra:"striped" };
var evilObject = { names: [null] };
var cleanMe = { names: [], testField: null };
var validationContext = arraySchema.newContext();
console.log("validObject valid?", validationContext.validate(validObject));
console.log("validEmptyObject valid?", validationContext.validate(validEmptyObject));
console.log("invalidObject valid?", validationContext.validate(invalidObject));
console.log("certainlyInvalidObject valid?", validationContext.validate(certainlyInvalidObject));
console.log("evilObject valid?", validationContext.validate(evilObject));
console.log("cleanMe valid?", validationContext.validate(cleanMe));
arraySchema.clean(validObject);
arraySchema.clean(validEmptyObject);
arraySchema.clean(invalidObject);
arraySchema.clean(certainlyInvalidObject);
arraySchema.clean(evilObject);
arraySchema.clean(cleanMe);
console.log("validObject:", JSON.stringify(validObject));
console.log("validEmptyObject:", JSON.stringify(validEmptyObject));
console.log("invalidObject:", JSON.stringify(invalidObject));
console.log("certainlyInvalidObject:", JSON.stringify(certainlyInvalidObject));
console.log("evilObject:", JSON.stringify(evilObject));
console.log("cleanMe:", JSON.stringify(cleanMe));

Expected output:

validObject valid? true
validEmptyObject valid? true
invalidObject valid? false
evilObject valid? false
cleanMe valid? false
validObject: {"names":["String"]}
validEmptyObject: {"names":[]}
invalidObject: {"names":[]}
certainlyInvalidObject: {}
evilObject: {"names":[]}
cleanMe: {"names":[]}

Actual output:

validObject valid? true                 | OK
validEmptyObject valid? true            | OK
invalidObject valid? false              | OK
certainlyInvalidObject valid? false     | OK
evilObject valid? true                  | error
cleanMe valid? true                     | error
validObject: {"names":["String"]}       | OK
validEmptyObject: {"names":[]}          | OK
invalidObject: {"names":[{}]}           | error
certainlyInvalidObject: {}              | OK
evilObject: {"names":[null]}            | error
cleanMe: {"names":[],"testField":null}  | error

[aldeed]

Let’s take these one by one:

1. evilObject should not be valid. I agree. Maybe bug.
2. cleanMe should not be valid. I disagree. testField is optional and there are no minimum number of array items required.
3. invalidObject should be [] instead of [{}] after cleaning. Maybe.
4. null should be removed from evilObject array. I’m not really sure whether there might be valid use cases for having null array items, and since you can’t set an array item schema as optional, there’s really no way to know whether cleaning should remove them or not. Maybe it could be a new option on the clean function (leaveNullsInArrays: true).
5. testField: null should not be in cleanMe after cleaning it. I agree, but this seems like a pretty basic cleaning which I thought we had tests for, so I’m surprised it was not cleaned.

I can add tests for any of these that don’t already have them, and then fix as appropriate.

[aldeed]

Thanks for your patience. SimpleSchema 2.0.0-rc.1 is now released and should fix this bug.

There are a number of breaking changes when updating to 2.0, so be sure to check out the change log. If you use aldeed:collection2, you will need to use 2.10.0 or higher of that package in order to use SimpleSchema 2.0. If you use autoform, it is not yet updated to work with SimpleSchema 2.0, but hopefully soon.

SimpleSchema is now an isomorphic NPM package, so you can check out the updated readme and file issues over at the other repo. The Meteor wrapper package will exist for now but eventually I will probably deprecate support for it.

This is still a beta/RC and I do expect people will find issues, so use with caution. Production use is not yet recommended. That said, there are more and better unit tests than ever before, and the codebase should be much easier for others to read through and debug quickly.