With this vulnerability, an attacker can bypass any security checks enforced by class-validator.

When class-validator is used to validate user-input, the attributes in the user-input object will be transformed into the validation class instance.
However, the transforming procedure will overwrite the internal attribute of validation class instance (e.g., constructor attribute) if the attacke

What

I suggest to make the return statement of form.submit() unified for all its branching.

Why

Current behavior

Now calling form.submit() returns two different things based on the validity of a form:

1. Returns undefined if a form is invalid.
2. Returns Promise<response> after the dispatched action.

Expected behavior

Calling form.submit() always returns

To allow support for:

string().in('foo', 'bar');
string().in(['foo', 'bar']);