Skip to content

fix(mimetype-content-wrapper): clone object per mimetype to avoid shared references#3945

Open
yogeshwaran-c wants to merge 1 commit into
nestjs:masterfrom
yogeshwaran-c:fix/mimetype-content-wrapper-shared-reference
Open

fix(mimetype-content-wrapper): clone object per mimetype to avoid shared references#3945
yogeshwaran-c wants to merge 1 commit into
nestjs:masterfrom
yogeshwaran-c:fix/mimetype-content-wrapper-shared-reference

Conversation

@yogeshwaran-c

Copy link
Copy Markdown
Contributor

Summary

MimetypeContentWrapper#wrap builds the OpenAPI content object by mapping each media type to removeUndefinedKeys(obj) — but it reuses the same object reference for every media type and passes the caller's object directly into removeUndefinedKeys (which mutates in place).

Two consequences for responses/request bodies declared with multiple media types (e.g. @ApiProduces('application/json', 'application/xml') or multiple @ApiConsumes):

  1. Aliased entries — every media-type entry in content points to the same object instance, so mutating one media type's schema later silently mutates all of them.
  2. Source mutationremoveUndefinedKeys strips keys from the caller's original object rather than a copy.

Reproduction (current behavior):

const { content } = new MimetypeContentWrapper().wrap(
  ['application/json', 'application/xml'],
  { schema: { type: 'string' } }
);

content['application/json'] === content['application/xml']; // true (bug)
content['application/json'].schema.type = 'mutated';
content['application/xml'].schema.type; // 'mutated' (leaked)

The fix clones the object per media type with lodash cloneDeep (already used elsewhere in the codebase) so each entry is independent and the caller's source object is left untouched.

Test plan

Added test/services/mimetype-content-wrapper.spec.ts covering:

  • wrapping under each provided mimetype
  • stripping undefined keys
  • distinct object/schema references between media types (fails before the fix)
  • caller's source object is not mutated (fails before the fix)
npx vitest run test/services            # 71 passed (incl. new spec)
npm run lint                            # exit 0
npm run build                           # exit 0

…red references

MimetypeContentWrapper#wrap reused the same object reference for every
media type and passed the caller's object directly to removeUndefinedKeys.
As a result, all media-type entries in the generated content object aliased
a single instance, and the caller's source object was mutated. Mutating one
media type's schema (or any later transform) silently affected the others.

Clone the object per mimetype with lodash cloneDeep so each media-type entry
is independent and the caller's source object is left untouched.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant