How do you write a custom pipe that sanitizes a string input (trim and lowercase) in NestJS?

Q: How do you write a custom pipe that sanitizes a string input (trim and lowercase) in NestJS?

@Injectable() export class SanitizeStringPipe implements PipeTransform { transform(value: string, metadata: ArgumentMetadata): string { if (typeof value !== 'string') return value; // pass non-strings through return value.trim().toLowerCase(); } } // Applied at param level — only processes the 'search' query param @Get('search') search(@Query('search', SanitizeStringPipe) query: string) { return this.service.search(query); } // Applied at handler level — processes all params of this route @Get() @UsePipes(SanitizeStringPipe) findAll( @Query('name') name: string, @Query('city') city: string, ) {} Always guard non-target types with typeof or metadata.metatype checks — pass them through unchanged. Use PipeTransform generics to make the transformation contract explicit. Param-level application is the most precise — only the targeted argument is processed. Handler-level @UsePipes() applies to all arguments — useful for bulk sanitization. Stateless pipes (no injected services) can be used as class references without new.

Difficulty: 5/10

pipes, validation, string sanitization

Implement PipeTransform with string generic types, guard against non-string inputs with a typeof check, and return the sanitized value. Apply at param level for targeted sanitization or at handler level with @UsePipes() for all string arguments of that route.

SanitizeStringPipe implementation and usage

Custom pipe design best practices:

1
Always guard non-target types with typeof or metadata.metatype checks — pass them through unchanged.
2
Use PipeTransform<Input, Output> generics to make the transformation contract explicit.
3
Param-level application is the most precise — only the targeted argument is processed.
4
Handler-level @UsePipes() applies to all arguments — useful for bulk sanitization.
5
Stateless pipes (no injected services) can be used as class references without new.

Scenario Questions

0-2 years experience

1Can you walk me through how you'd implement a NestJS pipe that trims whitespace and lowercases a string coming from a request body?
2If you applied your pipe to a DTO property that sometimes receives null, what would happen and how would you handle it?
3Where would you register this pipe if you only want it to affect a single controller method?

Follow-up Questions

What edge cases did you consider when writing the pipe?
How would you test this pipe in isolation and as part of an integration test?
Can you discuss any potential security implications of sanitizing inputs this way?