TypeScript Unsafe Type Guard

Description

Type guards that always return true or use assertions without validation create type confusion, allowing untrusted data to bypass security checks.

What Shoulder detects

Type guard '{function}' uses 'is' predicate but lacks proper runtime validation. This creates type confusion vulnerabilities.

How to fix

Implement proper runtime validation in type guards.

```typescript
function isUser(obj: unknown): obj is User {
  if (typeof obj !== 'object' || obj === null) {
    return false;
  }
  const u = obj as Record<string, unknown>;
  return (
    typeof u.id === 'number' &&
    typeof u.email === 'string'
  );
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-704/unsafe-type-guard

Applies to

Languages

🔷 TypeScript

Frameworks

typescript

References

Documentation ↗ OWASP ↗ Learn about CWE-704

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=typescript-unsafe-type-guard .