TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679
JavaScript Jabber29 Touko

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Jaksot(734)

094 JSJ BonsaiJS with Tobi Reiss

094 JSJ BonsaiJS with Tobi Reiss

The panelists talk to Tobi Reiss, the creator of BonsaiJS.Special Guest: Tobi Reiss. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

31 Tammi 201443min

093 JSJ The New York Times and JavaScript with Eitan Konigsburg, Alastair Coote and Reed Emmons

093 JSJ The New York Times and JavaScript with Eitan Konigsburg, Alastair Coote and Reed Emmons

The panelists discuss The New York Times and JavaScript with Eitan Konigsburg, Alastair Coote and Reed Emmons.Special Guests: Alastair Coote, Eitan Konigsburg, and Reed Emmons. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

24 Tammi 201454min

092 JSJ The MEAN Stack with Ward Bell and Valeri Karpov

092 JSJ The MEAN Stack with Ward Bell and Valeri Karpov

The panelists discuss the MEAN stack with Ward Bell and Valeri Karpov.Special Guests: Valeri Karpov and Ward Bell . Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

17 Tammi 20141h 4min

091 JSJ JSON APIs

091 JSJ JSON APIs

The panelists discuss JSON APIs. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

10 Tammi 201457min

090 JSJ Users Groups

090 JSJ Users Groups

The panelists talk about how to create and maintain Users Groups. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

3 Tammi 201439min

089 JSJ The Node Security Project with Adam Baldwin

089 JSJ The Node Security Project with Adam Baldwin

The panelists talk to The Node Security Project founder and organizer, Adam Baldwin.Special Guest: Adam Baldwin. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

27 Joulu 201352min

088 JSJ Lazy.js with Daniel Tao

088 JSJ Lazy.js with Daniel Tao

The panelists talk to Daniel Tao, maintainer of Lazy.js.Special Guest: Daniel Tao. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

20 Joulu 201346min

087 JSJ TC39 with Alex Russell

087 JSJ TC39 with Alex Russell

The panelists discuss TC39 with Alex Russell.Special Guest: Alex Russell. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

13 Joulu 20131h 3min

Suosittua kategoriassa Liike-elämä ja talous

sijotuskasti
psykopodiaa-podcast
rss-rahapodi
mimmit-sijoittaa
ostan-asuntoja-podcast
pomojen-suusta
rss-seuraava-potilas
taloudellinen-mielenrauha
rss-neuvottelija-sami-miettinen
rss-porssipuhetta
rss-lahtijat
rss-bisnesta-bebeja
rss-sisalto-kuntoon
rss-paasipodi
leadcast
sijoitusovi-podcast
rss-rahamania
jahtaa-unelmiasi
rss-ammattipodcast
rss-turvacast