TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679
JavaScript Jabber29 Mai

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Episoder(734)

110 JSJ Zones with Brian Ford

110 JSJ Zones with Brian Ford

The panelists discuss zone.js with Brian Ford.Special Guest: Brian Ford. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

28 Mai 201438min

109 JSJ Dependency Injection in JavaScript with Vojta Jína & Misko Hevery

109 JSJ Dependency Injection in JavaScript with Vojta Jína & Misko Hevery

The panelists discuss dependency injection with Vojta Jína & Misko Hevery.Special Guests: Miško Hevery and Vojta Jína. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

21 Mai 201446min

108 JSJ AngularJS with Igor Minar

108 JSJ AngularJS with Igor Minar

The panelists have Igor Minar back on the show to discuss AngularJS in detail.Special Guest: Igor Minar. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

14 Mai 201446min

107 JSJ ClojureScript & Om with David Nolen

107 JSJ ClojureScript & Om with David Nolen

The panelists talk to David Nolen about ClojureScript and Om.Special Guest: David Nolen. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

7 Mai 201452min

106 JSJ Protractor with Julie Ralph

106 JSJ Protractor with Julie Ralph

The panelists talk to Julie Ralph about AngularJS's protractor.Special Guest: Julie Ralph. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

30 Apr 201448min

105 JSJ JSConf and Organizing Conferences with Chris Williams

105 JSJ JSConf and Organizing Conferences with Chris Williams

The panelists discuss JSConf and conference organization with Chris Williams.Special Guest: Chris Williams. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

23 Apr 20141h 16min

104 JSJ Hypermedia APIs with Steve Klabnik

104 JSJ Hypermedia APIs with Steve Klabnik

The panelists discuss hypermedia APIs with Steve KlabnikSpecial Guest: Steve Klabnik. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

16 Apr 201459min

103 JSJ Robots with Raquel Vélez

103 JSJ Robots with Raquel Vélez

The panelists talk to Raquel Vélez about robotics and JavaScript.Special Guest: Raquel Vélez. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

9 Apr 20141h 4min

Populært innen Business og økonomi

stopp-verden
lydartikler-fra-aftenposten
dine-penger-pengeradet
e24-podden
rss-penger-polser-og-politikk
rss-borsmorgen-okonominyhetene
kommentarer-fra-aftenposten
pengepodden-2
finansredaksjonen
utbytte
pengesnakk
tid-er-penger-en-podcast-med-peter-warren
morgenkaffen-med-finansavisen
rss-markedspuls-2
stormkast-med-valebrokk-stordalen
livet-pa-veien-med-jan-erik-larssen
rss-investering-gjort-enkelt
rss-fri-kontantstrom
okonomiamatorene
paretopodden