@everystack/server 0.4.35 → 0.4.37

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@everystack/server` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.37] - 2026-10-18
+
+### Fixed
+
+- an action named __proto__ in a plugin or app action map is refused at init
+
+## [0.4.36] - 2026-10-18
+
+### Fixed
+
+- the Lambda entry strips edge query params (_v by default) before routing
+
 ## [0.4.35] - 2026-10-14
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.35",
+  "version": "0.4.37",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -193,7 +193,7 @@
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
     "@everystack/auth": "0.4.9",
-    "@everystack/cli": "0.4.99"
+    "@everystack/cli": "0.4.100"
   },
   "scripts": {
     "test": "jest",

package/src/index.ts

@@ -17,6 +17,7 @@ import type {
 
 import { log } from './log';
 import { buildTimingHeaders } from './timing';
+import { DEFAULT_STRIP_QUERY_PARAMS, stripQueryParams } from './strip-query-params';
 
 export { buildTimingHeaders } from './timing';
 export type { TimingHeaderOptions } from './timing';
@@ -99,6 +100,13 @@ export interface LambdaHandlerOptions {
   logSink?: LogSink;
   /** Emit Server-Timing headers on responses. Default true. */
   observability?: boolean;
+  /**
+   * Query params removed from every HTTP request before routing, matched by decoded name whatever
+   * the value. The CDN edge appends `?_v=<epoch>` and CloudFront forwards the whole query string,
+   * so without this the REST handler would answer 400 to a param with no operator. List any params
+   * your own edge adds. Default `['_v']`; `[]` disables stripping.
+   */
+  stripQueryParams?: string[];
 }
 
 // --- Event Adapter ---
@@ -256,7 +264,10 @@ export function createLambdaHandler(
 
     try {
       const { router } = await ensureInitialized();
-      const request = eventToRequest(httpEvent);
+      const request = stripQueryParams(
+        eventToRequest(httpEvent),
+        options.stripQueryParams ?? DEFAULT_STRIP_QUERY_PARAMS,
+      );
       const path = httpEvent.rawPath;
       const method = httpEvent.requestContext.http.method;
       const handlerFn = router(path, method);

package/src/plugin.ts

@@ -36,6 +36,7 @@ import {
   log,
 } from './index';
 import { splitSqlStatements, stripSqlComments } from './sql-lex';
+import { DEFAULT_STRIP_QUERY_PARAMS, stripQueryParams } from './strip-query-params';
 
 // --- Plugin Types ---
 
@@ -138,6 +139,13 @@ export interface PluginLambdaHandlerOptions {
    * here, not in the HTTP-facing API function.
    */
   http?: boolean;
+  /**
+   * Query params removed from every HTTP request before routing, matched by decoded name whatever
+   * the value. The CDN edge appends `?_v=<epoch>` and CloudFront forwards the whole query string,
+   * so without this the REST handler would answer 400 to a param with no operator. List any params
+   * your own edge adds. Default `['_v']`; `[]` disables stripping.
+   */
+  stripQueryParams?: string[];
 }
 
 // --- Plugin Lambda Handler Implementation ---
@@ -164,6 +172,17 @@ export function createPluginLambdaHandler(
       contributions.push(await plugin(ctx));
     }
 
+    // An OWN `__proto__` key (parsed JSON, a computed key) cannot be an action: Object.assign would
+    // run the `__proto__` setter on the map instead of adding it, and the spread below would define
+    // it as an own key. Refuse it at init rather than drop or dispatch it.
+    const refuseProtoKey = (source: string, actions: Record<string, ActionHandler> | undefined) => {
+      if (actions && Object.hasOwn(actions, '__proto__')) {
+        throw new Error(`[everystack/server] ${source} action name "__proto__" is not allowed`);
+      }
+    };
+    for (const contribution of contributions) refuseProtoKey('plugin', contribution.actions);
+    refuseProtoKey('app', options.actions);
+
     // Collect actions (app-level takes precedence on collision)
     const pluginActions: Record<string, ActionHandler> = {};
     for (const contribution of contributions) {
@@ -272,7 +291,10 @@ export function createPluginLambdaHandler(
 
     try {
       const { router, logSink } = await ensureInitialized();
-      const request = eventToRequest(httpEvent);
+      const request = stripQueryParams(
+        eventToRequest(httpEvent),
+        options.stripQueryParams ?? DEFAULT_STRIP_QUERY_PARAMS,
+      );
       const path = httpEvent.rawPath;
       const method = httpEvent.requestContext.http.method;
       const handlerFn = router!(path, method);

package/src/strip-query-params.ts

@@ -0,0 +1,41 @@
+/**
+ * Internal (not exported from the package): removes edge-added query params from a Request before
+ * routing. Both Lambda entry points (createLambdaHandler, createPluginLambdaHandler) call it right
+ * after eventToRequest.
+ */
+
+/** The CDN edge's cache-version param (cacheVersionFeature, docs/caching.md). */
+export const DEFAULT_STRIP_QUERY_PARAMS: readonly string[] = ['_v'];
+
+/** Decodes a raw query-pair name the way a form-encoded parser does; null if it cannot decode. */
+function decodeName(raw: string): string | null {
+  try {
+    return decodeURIComponent(raw.replace(/\+/g, ' '));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Returns `request` with every query pair whose decoded name is in `names` removed. The kept pairs
+ * keep their exact bytes and order (no URLSearchParams re-serialization). When nothing is removed
+ * the same Request object is returned; otherwise a new Request carries the original method,
+ * headers and body.
+ */
+export function stripQueryParams(request: Request, names: readonly string[]): Request {
+  if (names.length === 0) return request;
+  const url = request.url;
+  const q = url.indexOf('?');
+  if (q === -1) return request;
+
+  const pairs = url.slice(q + 1).split('&');
+  const kept = pairs.filter((pair) => {
+    const eq = pair.indexOf('=');
+    const name = decodeName(eq === -1 ? pair : pair.slice(0, eq));
+    return name === null || !names.includes(name);
+  });
+  if (kept.length === pairs.length) return request;
+
+  const query = kept.join('&');
+  return new Request(url.slice(0, q) + (query ? '?' + query : ''), request);
+}