SH109: NestJS request validation not enabled

Severity: medium · Category: authentication · Applies to: nestjs

Why it matters

Without a ValidationPipe, the decorators on your DTO classes are ignored and request bodies reach your handlers unchecked, which invites injection and mass-assignment bugs.

How to fix

Add app.useGlobalPipes(new ValidationPipe({ whitelist: true })) in main.ts, or register it with the APP_PIPE provider.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH109

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH109