exactMirror fails for wildcard route params schema containing "*" key — warn printed on every request

What version of Elysia is running?

elysia: 1.4.29 (also present in 1.4.30)

What platform is your computer?

Linux 6.1.0-23-amd64 x86_64 unknown

What environment are you using

bun: 1.4.0

Are you using dynamic mode?

no

What steps can reproduce the bug?

import { Elysia, t } from 'elysia';

const app = new Elysia().get(
	'/uploads/:type/*',
	({ params }) => ({ ok: true, type: params.type, p: params['*'] }),
	{
		params: t.Object({
			type: t.String(),
			'*': t.String(),
		}),
	},
);

app.listen(3000);

Then hit GET /uploads/images/2024-11-08/a.jpg — the warning above is printed for every request, while the response is still 200 {"ok":true,...}.

A route without an explicit params schema (e.g. app.get('/', ...)) does not trigger the warning, which confirms the trigger is the explicit object schema with an "" property.

What is the expected behavior?

No response

What do you see instead?

Failed to create exactMirror. Please report the following code to https://github.com/elysiajs/elysia/issues
log: {
  [Symbol(TypeBox.Kind)]: "Object",
  type: "object",
  required: [ "type", "*" ],
  properties: {
    type: { [Symbol(TypeBox.Kind)]: "String", type: "string" },
    "*": { [Symbol(TypeBox.Kind)]: "String", type: "string" },
  },
  additionalProperties: false,
}

Additional information

Root cause analysis

1. Elysia defaults to normalize: true, and when an object schema has additionalProperties: false it builds a fast decode function via exact-mirror (validator.Clean):
   • node_modules/elysia/dist/schema.js (~line 455): if (normalize && schema.additionalProperties === false) → validator.Clean = createMirror(schema, { TypeCompiler, ... }), wrapped in try/catch that falls back to createCleaner and prints the warning.
2. [email protected]'s isSpecialProperty check only tests for a blacklist of characters:
   javascript复制

   const isSpecialProperty = (name) =>
     /(\ |-|\t|\n|\.|\[|\]|\{|\})/.test(name) || !isNaN(+name[0]);

   "*" is not in that list and isNaN(+"*") is true, so "*" is treated as a plain identifier. Property access is then emitted as v.* and object literal keys as {*: ...} — invalid JavaScript — and new Function(...) throws a SyntaxError.
3. Elysia catches it, logs the warning, and falls back to createCleaner. Because the mirror was never cached, the same failed attempt + warning repeats on every request.

Fix status / why bumping Elysia does not help

• [email protected] already fixed this by switching isSpecialProperty to a whitelist:
  javascript复制

  const isSpecialProperty = (name) => !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name);

• However elysia 1.4.30 still depends on "exact-mirror": "^0.2.7", and exact-mirror 1.2.x requires typebox >= 1.1.0 as a peer dependency while elysia 1.4.x requires @sinclair/typebox < 1 — so a project cannot upgrade exact-mirror to the fixed version without breaking typebox compatibility.

Suggested fixes (any of)

1. Elysia: bump the dependency to exact-mirror@^1.2.x (and align typebox accordingly), or
2. Elysia: special-case property names emitted by exact-mirror (avoid object schemas that contain wildcard-style keys such as "*" from entering the mirror path), or
3. exact-mirror: backport the whitelist isSpecialProperty fix to a 0.2.x release so ^0.2.7 resolvers pick it up.

Have you try removing the node_modules and bun.lock and try again yet?

No response