Validation returns raw form value instead of parsed value (standard schema validators) #1723
Description
Describe the bug
When validating with a “standard” schema, the form returns the original (unparsed) value instead of the schema-parsed value. This causes:
- Untrusted raw values from the frontend to bypass validation/sanitization, which is unsafe.
- Common transformation use cases (e.g., trimming, type coercion, normalization) to be skipped.
Your minimal, reproducible example
https://stackblitz.com/edit/stackblitz-starters-doaombkp?file=app%2Fpage.tsx
Steps to reproduce
- Click the Submit button.
- Inspect the result: you can confirm the unparsed value under the
actualkey.
Expected behavior
On successful validation (no issues), the validator should return the parsed value.
How often does this bug happen?
Every time
Screenshots or Videos
Platform
- MacOS
- Chrome
TanStack Form adapter
react-form
TanStack Form version
1.19.3
TypeScript version
5.2.2
Additional context
Proposed change:
packages/form-core/src/standardSchemaValidator.ts: L82
- if (!result.issues) return;
+ if (!result.issues) return { ok: true, data: result.value };packages/react-form/src/nextjs(remix,start)/createServerValidate.ts
- const onServerError = await runValidator({
- value: values,
- validationSource: "form"
- });
- if (!onServerError) return values;
+ const validated = await runValidator({
+ value: values,
+ validationSource: "form"
+ });
+ if (validated.ok) return validated.data;