@mastra/server-adapters-test-suite 0.1.1 → 0.1.2-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @mastra/server-adapters-test-suite
 
+## 0.1.2-alpha.0
+
+### Patch Changes
+
+- Added coverage for reserved field and parameter names in shared adapter request parsing tests ([#26683](https://github.com/mastra-ai/mastra/pull/26683))
+
+- Updated dependencies [[`a65d0c7`](https://github.com/mastra-ai/mastra/commit/a65d0c788824081f36ccd95078a8d1214ff687c4), [`cb0201a`](https://github.com/mastra-ai/mastra/commit/cb0201ab41c36723b9f6e331464e5c74326865ed), [`e89310a`](https://github.com/mastra-ai/mastra/commit/e89310a8db29a663a85c6a31a8c376cc8f59c129), [`590d6ca`](https://github.com/mastra-ai/mastra/commit/590d6ca9fa6ccf8b55dcf2e98da080ee1a348f67)]:
+  - @mastra/core@1.76.0-alpha.9
+  - @mastra/server@1.76.0-alpha.9
+
 ## 0.1.1
 
 ### Patch Changes

package/dist/index.js

@@ -927,7 +927,8 @@ async function createDefaultTestContext() {
 				"trace-query",
 				"trace-query-discovery",
 				"trace-aggregate",
-				"thread-query"
+				"thread-query",
+				"span-query"
 			]);
 			vi.spyOn(observability, "queryTraces").mockResolvedValue({
 				traces: [],
@@ -949,6 +950,10 @@ async function createDefaultTestContext() {
 				threads: [],
 				page: { next: null }
 			});
+			vi.spyOn(observability, "querySpans").mockResolvedValue({
+				spans: [],
+				page: { next: null }
+			});
 			await observability.createSpan({ span: {
 				spanId: "test-span",
 				traceId: "test-trace",
@@ -1764,6 +1769,48 @@ function createRouteAdapterTestSuite(config) {
 			expect(response.status).toBe(200);
 			expect(response.data).toEqual({ userId: "query-user-123" });
 		});
+		it("ignores special object keys in query params while preserving legitimate params", async () => {
+			await setup.adapter.registerRoute(app, {
+				method: "GET",
+				path: "/test/query-special-keys",
+				responseType: "json",
+				handler: async (params) => ({
+					filter: typeof params.filter === "string" ? JSON.parse(params.filter) : null,
+					tag: params.tag ?? null,
+					keys: Object.keys(params).filter((k) => ![
+						"mastra",
+						"requestContext",
+						"tools",
+						"taskStore",
+						"abortSignal",
+						"registeredTools",
+						"routePrefix",
+						"request"
+					].includes(k))
+				})
+			});
+			const response = await executeHttpRequest(app, {
+				method: "GET",
+				path: "/api/test/query-special-keys",
+				query: Object.fromEntries([
+					["__proto__[polluted]", "yes"],
+					["constructor[prototype]", "yes"],
+					["prototype[x]", "yes"],
+					["filter[__proto__]", "yes"],
+					["filter[status]", "active"],
+					["tag", ["a", "b"]],
+					["page", "2"]
+				])
+			});
+			expect(response.status).toBe(200);
+			const data = response.data;
+			expect(data.filter).toEqual({ status: "active" });
+			expect(Array.isArray(data.tag) ? data.tag : [data.tag]).toContain("b");
+			expect(data.keys).not.toContain("__proto__");
+			expect(data.keys).not.toContain("constructor");
+			expect(data.keys).not.toContain("prototype");
+			expect({}.polluted).toBeUndefined();
+		});
 		describe.each([{
 			version: "v3",
 			recordSchema: z$1.record(z$1.string(), z$1.string()),
@@ -3488,6 +3535,59 @@ function createMultipartTestSuite(config) {
 				message: "Hello, World!"
 			});
 		});
+		it("should ignore form fields named with special object keys", async () => {
+			const { adapter, app } = await setupAdapter(context);
+			const testRoute = {
+				method: "POST",
+				path: "/test/upload-special-keys",
+				responseType: "json",
+				handler: async (params) => {
+					return {
+						success: true,
+						name: params.name ?? null,
+						options: params.options ?? null,
+						inheritedIsAdmin: params.isAdmin ?? null,
+						bodyKeys: Object.keys(params).filter((k) => ![
+							"mastra",
+							"requestContext",
+							"tools",
+							"taskStore",
+							"abortSignal",
+							"registeredTools",
+							"routePrefix",
+							"request"
+						].includes(k))
+					};
+				}
+			};
+			applyMiddleware(app, getContextMiddleware(adapter));
+			await registerRoute(adapter, app, testRoute, { prefix: "" });
+			serverInfo = await startServer(app);
+			const formData = new FormData();
+			formData.append("__proto__", JSON.stringify({ isAdmin: true }));
+			formData.append("constructor", JSON.stringify({ prototype: { isAdmin: true } }));
+			const fileBlob = new Blob([new Uint8Array([
+				1,
+				2,
+				3
+			])], { type: "application/octet-stream" });
+			formData.append("prototype", fileBlob, "payload.bin");
+			formData.append("name", "legit-recording");
+			formData.append("options", JSON.stringify({ language: "en" }));
+			const response = await fetch(`${serverInfo.baseUrl}/test/upload-special-keys`, {
+				method: "POST",
+				body: formData
+			});
+			expect(response.status).toBe(200);
+			const result = await response.json();
+			expect(result.name).toBe("legit-recording");
+			expect(result.options).toMatchObject({ language: "en" });
+			expect(result.inheritedIsAdmin).toBeNull();
+			expect(result.bodyKeys).not.toContain("__proto__");
+			expect(result.bodyKeys).not.toContain("constructor");
+			expect(result.bodyKeys).not.toContain("prototype");
+			expect({}.isAdmin).toBeUndefined();
+		});
 	});
 }
 //#endregion