@mastra/nestjs 0.2.35-alpha.8 → 0.2.35-alpha.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.js CHANGED
@@ -1,6 +1,6 @@
1
1
  import { createRequire } from "module";
2
2
  import { All, BadRequestException, Catch, Controller, ForbiddenException, Get, HttpException, HttpStatus, Inject, Injectable, Logger, Module, NotFoundException, PayloadTooLargeException, Req, Res, Scope, ServiceUnavailableException, SetMetadata, UnauthorizedException, UseFilters, UseGuards, UseInterceptors } from "@nestjs/common";
3
- import { HTTPException, MASTRA_CLIENT_TYPE_HEADER, MASTRA_IS_STUDIO_KEY, SERVER_ROUTES, getCustomHTTPExceptionResponse, isReservedRequestContextKey, isStudioClientTypeHeader, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
3
+ import { HTTPException, MASTRA_CLIENT_TYPE_HEADER, MASTRA_IS_STUDIO_KEY, SERVER_ROUTES, getCustomHTTPExceptionResponse, isReservedRequestContextKey, isSafeObjectKey, isStudioClientTypeHeader, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
4
4
  import { formatZodError, isZodError as isZodError$1 } from "@mastra/server/handlers/error";
5
5
  import { RequestContext } from "@mastra/core/request-context";
6
6
  import { MASTRA_USER_KEY, coreAuthMiddleware } from "@mastra/server/auth";
@@ -10952,10 +10952,11 @@ function parseMultipartFormData(request, options = {}) {
10952
10952
  reject(new PayloadTooLargeException(`File size limit exceeded${maxSize ? ` (max: ${formatBytes(maxSize)})` : ""}`));
10953
10953
  });
10954
10954
  file.on("end", () => {
10955
- if (!limitExceeded) result[fieldname] = Buffer.concat(chunks);
10955
+ if (!limitExceeded && isSafeObjectKey(fieldname)) result[fieldname] = Buffer.concat(chunks);
10956
10956
  });
10957
10957
  });
10958
10958
  busboy.on("field", (fieldname, value) => {
10959
+ if (!isSafeObjectKey(fieldname)) return;
10959
10960
  try {
10960
10961
  result[fieldname] = JSON.parse(value);
10961
10962
  } catch {