TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679
JavaScript Jabber29 Mai

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Episoder(734)

102 JSJ Angular and Open Source Projects with Brad Green

102 JSJ Angular and Open Source Projects with Brad Green

The panelists talk to Brad Green of Google, about Angular.js and managing open source projects.Special Guest: Brad Green. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

2 Apr 201447min

101 JSJ js-git with Tim Caswell

101 JSJ js-git with Tim Caswell

The panelists talk to Tim Caswell about js-git.Special Guest: Tim Caswell. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

19 Mar 201450min

100 JSJ Centennial Episode Celebration

100 JSJ Centennial Episode Celebration

The panelists celebrate their 100th episode! Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

12 Mar 201449min

099 JSJ npm, Inc. with Isaac Schlueter, Laurie Voss, and Rod Boothby

099 JSJ npm, Inc. with Isaac Schlueter, Laurie Voss, and Rod Boothby

The panelists discuss npm, Inc. with Isaac Schlueter, Laurie Voss, and Rod Boothby.Special Guests: Isaac Schleuter, Laurie Voss, and Rod Boothby. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

5 Mar 201456min

098 JSJ Assemble.io with Brian Woodward and Jon Schlinkert

098 JSJ Assemble.io with Brian Woodward and Jon Schlinkert

The panelists speak with Brian Woodward and Job Schlinkert about Assemble.io.Special Guests: Brian Woodward and Jon Schlinkert. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

26 Feb 201443min

097 JSJ Gulp.js with Eric Schoffstall

097 JSJ Gulp.js with Eric Schoffstall

The panelists talk to Eric Schoffstall, the creator of Gulp.js.Special Guest: Eric Schoffstall. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

19 Feb 201442min

096 JSJ The Challenges of Large Single Page JavaScript Applications with Bart Wood

096 JSJ The Challenges of Large Single Page JavaScript Applications with Bart Wood

The panelists talk to Bart Wood about large single page JavaScript applications.Special Guest: Bart Wood. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

14 Feb 201445min

095 JSJ AngularUI with Dean Sofer

095 JSJ AngularUI with Dean Sofer

The panelists talk to Dean Sofer about AngularUI.Special Guest: Dean Sofer. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

7 Feb 201450min

Populært innen Business og økonomi

stopp-verden
lydartikler-fra-aftenposten
dine-penger-pengeradet
e24-podden
rss-penger-polser-og-politikk
rss-borsmorgen-okonominyhetene
kommentarer-fra-aftenposten
pengepodden-2
finansredaksjonen
utbytte
pengesnakk
tid-er-penger-en-podcast-med-peter-warren
morgenkaffen-med-finansavisen
rss-markedspuls-2
stormkast-med-valebrokk-stordalen
livet-pa-veien-med-jan-erik-larssen
rss-investering-gjort-enkelt
rss-fri-kontantstrom
okonomiamatorene
paretopodden