Unsafe 'any' Type in Security-Sensitive Context

Description

Using 'any' type with untrusted input bypasses TypeScript's type safety, allowing unvalidated data to flow into security-sensitive operations.

What Shoulder detects

Variable declared with 'any' type receives untrusted input from {source}. This bypasses TypeScript's type safety and may lead to injection vulnerabilities.

How to fix

Replace 'any' with a specific interface or use 'unknown' with type guards.

```typescript
interface UserDTO {
  username: string;
  email: string;
}

const userData: UserDTO = req.body;
database.insert(userData);
```

Learn more: https://shoulder.dev/learn/typescript/cwe-704/unsafe-any-usage

Applies to

Languages

🔷 TypeScript

Frameworks

express fastify nestjs next

References

Documentation ↗ OWASP ↗ Learn about CWE-704

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=typescript-unsafe-any-usage .