tRPC Type Safety Bypass with Any

Description

Using 'any' type in tRPC procedures defeats type safety and allows unvalidated data to pass through, enabling injection and runtime errors.

What Shoulder detects

tRPC code uses 'any' type which defeats type safety. Use proper TypeScript types or Zod inference.

How to fix

Use Zod schemas and infer types instead of 'any'.

```typescript
import { z } from 'zod';

const getUserInput = z.object({
  userId: z.number().int().positive()
});

export const userRouter = router({
  getUser: publicProcedure
    .input(getUserInput)
    .query(async ({ input }) => {
      return await db.user.findUnique({ where: { id: input.userId } });
    })
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-704/type-inference-bypass

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

trpc

References

Documentation ↗ OWASP ↗ Learn about CWE-704

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=trpc-type-inference-bypass .