test(openapi): bracket notion prototype pollution

[dinwwwh]

Summary by CodeRabbit

• Tests
  • Added test coverage for prototype pollution safety, validating that the serializer properly handles and prevents related attack vectors.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 317b2067-035e-44fb-bda1-3541abbd3e81

📥 Commits

Reviewing files that changed from the base of the PR and between ba7984f and 30cddda.

📒 Files selected for processing (1)

• packages/openapi-client/src/adapters/standard/bracket-notation.test.ts

---

📝 Walkthrough

Walkthrough

A test case was added to verify that the bracket-notation serializer resists prototype pollution attacks. The test validates that attempting to pollute __proto__ and constructor properties through bracket notation keys leaves the result object and global prototypes unaffected.

Changes

Cohort / File(s)	Summary
Prototype Pollution Safety Tests packages/openapi-client/src/adapters/standard/bracket-notation.test.ts	Added comprehensive test case validating that the bracket-notation serializer safely rejects prototype pollution attempts on both top-level and nested objects, ensuring prototypes remain unpolluted.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• refactor: use NullProtoObj to avoid prototype pollution when creating objects with dynamic keys #576: Refactors bracket-notation implementation to use NullProtoObj for preventing prototype pollution — the implementation this test validates.

Poem

🐰 A test hops in with security cheer,
Prototype pollution? No place here!
Constructor and proto stay pure and clean,
The safest bracket-notations ever seen! 🛡️

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change—a new test case for prototype pollution vulnerabilities in bracket notation serialization.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[pkg-pr-new]

More templates

• @orpc/astro-playground
• @orpc/browser-extension-playground
• @orpc/bun-websocket-otel-playground
• @orpc/cloudflare-worker-playground
• @orpc/contract-first-playground
• @orpc/electron-playground
• @orpc/nest-playground
• @orpc/next-playground
• @orpc/nuxt-playground
• @orpc/solid-start-playground
• @orpc/svelte-kit-playground
• @orpc/tanstack-start-playground

@orpc/ai-sdk

npm i https://pkg.pr.new/@orpc/ai-sdk@1455

@orpc/arktype

npm i https://pkg.pr.new/@orpc/arktype@1455

@orpc/client

npm i https://pkg.pr.new/@orpc/client@1455

@orpc/contract

npm i https://pkg.pr.new/@orpc/contract@1455

@orpc/experimental-durable-iterator

npm i https://pkg.pr.new/@orpc/experimental-durable-iterator@1455

@orpc/hey-api

npm i https://pkg.pr.new/@orpc/hey-api@1455

@orpc/interop

npm i https://pkg.pr.new/@orpc/interop@1455

@orpc/json-schema

npm i https://pkg.pr.new/@orpc/json-schema@1455

@orpc/nest

npm i https://pkg.pr.new/@orpc/nest@1455

@orpc/openapi

npm i https://pkg.pr.new/@orpc/openapi@1455

@orpc/openapi-client

npm i https://pkg.pr.new/@orpc/openapi-client@1455

@orpc/otel

npm i https://pkg.pr.new/@orpc/otel@1455

@orpc/experimental-pino

npm i https://pkg.pr.new/@orpc/experimental-pino@1455

@orpc/experimental-publisher

npm i https://pkg.pr.new/@orpc/experimental-publisher@1455

@orpc/experimental-publisher-durable-object

npm i https://pkg.pr.new/@orpc/experimental-publisher-durable-object@1455

@orpc/experimental-ratelimit

npm i https://pkg.pr.new/@orpc/experimental-ratelimit@1455

@orpc/react

npm i https://pkg.pr.new/@orpc/react@1455

@orpc/react-query

npm i https://pkg.pr.new/@orpc/react-query@1455

@orpc/experimental-react-swr

npm i https://pkg.pr.new/@orpc/experimental-react-swr@1455

@orpc/server

npm i https://pkg.pr.new/@orpc/server@1455

@orpc/shared

npm i https://pkg.pr.new/@orpc/shared@1455

@orpc/solid-query

npm i https://pkg.pr.new/@orpc/solid-query@1455

@orpc/standard-server

npm i https://pkg.pr.new/@orpc/standard-server@1455

@orpc/standard-server-aws-lambda

npm i https://pkg.pr.new/@orpc/standard-server-aws-lambda@1455

@orpc/standard-server-fastify

npm i https://pkg.pr.new/@orpc/standard-server-fastify@1455

@orpc/standard-server-fetch

npm i https://pkg.pr.new/@orpc/standard-server-fetch@1455

@orpc/standard-server-node

npm i https://pkg.pr.new/@orpc/standard-server-node@1455

@orpc/standard-server-peer

npm i https://pkg.pr.new/@orpc/standard-server-peer@1455

@orpc/svelte-query

npm i https://pkg.pr.new/@orpc/svelte-query@1455

@orpc/tanstack-query

npm i https://pkg.pr.new/@orpc/tanstack-query@1455

@orpc/trpc

npm i https://pkg.pr.new/@orpc/trpc@1455

@orpc/valibot

npm i https://pkg.pr.new/@orpc/valibot@1455

@orpc/vue-colada

npm i https://pkg.pr.new/@orpc/vue-colada@1455

@orpc/vue-query

npm i https://pkg.pr.new/@orpc/vue-query@1455

@orpc/zod

npm i https://pkg.pr.new/@orpc/zod@1455

commit: 255476e

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces new test coverage to validate the bracket-notation serializer's robustness against prototype pollution attacks. The added tests specifically confirm that the serializer prevents malicious manipulation of object prototypes when deserializing data, thereby enhancing the security posture of the OpenAPI client.

Highlights

• Prototype Pollution Testing: Added a new test case to bracket-notation.test.ts to verify the serializer's resilience against prototype pollution vulnerabilities, ensuring it correctly handles __proto__ and constructor properties without affecting global prototypes.

Changelog

• packages/openapi-client/src/adapters/standard/bracket-notation.test.ts
  • Added a test case to ensure the standardBracketNotationSerializer is safe from prototype pollution.

Activity

• An automated summary was generated by coderabbit.ai highlighting the addition of test coverage for prototype pollution safety.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request adds a new test case to verify protection against prototype pollution in the bracket notation serializer. However, the underlying deserialization logic is still vulnerable to several prototype pollution vectors, including Array.prototype and Function.prototype pollution, and potential Denial of Service. Furthermore, the new test's assertions are incorrect, as they use dot notation to access __proto__ and constructor on null-prototype objects, which will lead to test failures. It is recommended to implement a more robust approach, such as blocking sensitive keys (__proto__, constructor, prototype), and to correct the test assertions to use bracket notation.