feat(rest): make qs arrayLimit configurable for query parsing

Signed-off-by: kauanAfonso <kauan.afonso@ibm.com>

Author: kauanAfonso

packages/rest/src/__tests__/acceptance/request-parsing/array-limit.acceptance.ts

@@ -0,0 +1,145 @@
+// Copyright IBM Corp. and LoopBack contributors 2024. All Rights Reserved.
+// Node module: @loopback/rest
+// This file is licensed under the MIT License.
+// License text available at https://opensource.org/licenses/MIT
+
+import {
+  Client,
+  createRestAppClient,
+  expect,
+  givenHttpServerConfig,
+} from '@loopback/testlab';
+import {get, param, RestApplication} from '../../..';
+
+describe('Query parameter array limit', () => {
+  let app: RestApplication;
+  let client: Client;
+
+  afterEach(async () => {
+    if (app) await app.stop();
+  });
+
+  context('with default arrayLimit (20)', () => {
+    beforeEach(async () => {
+      app = givenApplication();
+      await app.start();
+      client = createRestAppClient(app);
+    });
+
+    it('parses arrays with 20 items correctly', async () => {
+      const ids = Array.from({length: 20}, (_, i) => (i + 1).toString());
+      const query = ids.map(id => `ids=${id}`).join('&');
+
+      const response = await client.get(`/test?${query}`).expect(200);
+      expect(response.body.ids).to.eql(ids);
+    });
+
+    it('converts arrays with 21+ items to objects (qs default behavior)', async () => {
+      const ids = Array.from({length: 21}, (_, i) => (i + 1).toString());
+      const query = ids.map(id => `ids=${id}`).join('&');
+
+      const response = await client.get(`/test?${query}`).expect(200);
+
+      expect(response.body.ids).to.be.Object();
+      expect(Array.isArray(response.body.ids)).to.be.false();
+      expect(response.body.ids).to.have.property('0', '1');
+      expect(response.body.ids).to.have.property('20', '21');
+    });
+  });
+
+  context('with custom arrayLimit (100)', () => {
+    beforeEach(async () => {
+      app = givenApplication({
+        rest: {
+          queryParser: {
+            arrayLimit: 100,
+          },
+        },
+      });
+      await app.start();
+      client = createRestAppClient(app);
+    });
+
+    it('parses arrays with 21 items correctly', async () => {
+      const ids = Array.from({length: 21}, (_, i) => (i + 1).toString());
+      const query = ids.map(id => `ids=${id}`).join('&');
+
+      const response = await client.get(`/test?${query}`).expect(200);
+      expect(response.body.ids).to.eql(ids);
+      expect(Array.isArray(response.body.ids)).to.be.true();
+    });
+
+    it('parses arrays with 50 items correctly', async () => {
+      const ids = Array.from({length: 50}, (_, i) => (i + 1).toString());
+      const query = ids.map(id => `ids=${id}`).join('&');
+
+      const response = await client.get(`/test?${query}`).expect(200);
+      expect(response.body.ids).to.eql(ids);
+      expect(Array.isArray(response.body.ids)).to.be.true();
+    });
+
+    it('parses arrays with 100 items correctly', async () => {
+      const ids = Array.from({length: 100}, (_, i) => (i + 1).toString());
+      const query = ids.map(id => `ids=${id}`).join('&');
+
+      const response = await client.get(`/test?${query}`).expect(200);
+      expect(response.body.ids).to.eql(ids);
+      expect(Array.isArray(response.body.ids)).to.be.true();
+    });
+
+    it('converts arrays with 101+ items to objects (exceeds limit)', async () => {
+      const ids = Array.from({length: 101}, (_, i) => (i + 1).toString());
+      const query = ids.map(id => `ids=${id}`).join('&');
+
+      const response = await client.get(`/test?${query}`).expect(200);
+
+      expect(response.body.ids).to.be.Object();
+      expect(Array.isArray(response.body.ids)).to.be.false();
+      expect(response.body.ids).to.have.property('0', '1');
+      expect(response.body.ids).to.have.property('100', '101');
+    });
+  });
+
+  context('with arrayLimit set to 1000', () => {
+    beforeEach(async () => {
+      app = givenApplication({
+        rest: {
+          queryParser: {
+            arrayLimit: 1000,
+          },
+        },
+      });
+      await app.start();
+      client = createRestAppClient(app);
+    });
+
+    it('parses arrays with 500 items correctly', async () => {
+      const ids = Array.from({length: 500}, (_, i) => (i + 1).toString());
+      const query = ids.map(id => `ids=${id}`).join('&');
+
+      const response = await client.get(`/test?${query}`).expect(200);
+      expect(response.body.ids).to.eql(ids);
+      expect(Array.isArray(response.body.ids)).to.be.true();
+    });
+  });
+
+  function givenApplication(config?: object) {
+    const testApp = new RestApplication({
+      ...givenHttpServerConfig(),
+      ...config,
+    });
+
+    class TestController {
+      @get('/test')
+      test(
+        @param.array('ids', 'query', {type: 'string'})
+        ids?: string[],
+      ): object {
+        return {ids};
+      }
+    }
+
+    testApp.controller(TestController);
+    return testApp;
+  }
+});

packages/rest/src/rest.server.ts

@@ -40,6 +40,7 @@ import {IncomingMessage, ServerResponse} from 'http';
 import {ServerOptions} from 'https';
 import {dump} from 'js-yaml';
 import {cloneDeep} from 'lodash';
+import qs from 'qs';
 import {ServeStaticOptions} from 'serve-static';
 import {writeErrorToResponse} from 'strong-error-handler';
 import {BodyParser, REQUEST_BODY_PARSER_TAG} from './body-parsers';
@@ -327,6 +328,17 @@ export class RestServer
     if (this.config.router && typeof this.config.router.strict === 'boolean') {
       this._expressApp.set('strict routing', this.config.router.strict);
     }
+
+    // Configure query parser with custom arrayLimit if provided
+    const arrayLimit = this.config.queryParser?.arrayLimit ?? 20;
+    this._expressApp.set('query parser', (str: string) => {
+      return qs.parse(str, {
+        arrayLimit,
+        // Use extended mode (same as body-parser urlencoded)
+        allowPrototypes: false,
+        depth: 20,
+      });
+    });
   }
 
   /**
@@ -1180,6 +1192,20 @@ export interface RestServerResolvedOptions {
   openApiSpec: OpenApiSpecOptions;
   apiExplorer: ApiExplorerOptions;
   requestBodyParser?: RequestBodyParserOptions;
+  /**
+   * Query string parser options
+   */
+  queryParser?: {
+    /**
+     * Maximum number of array elements to parse in query parameters.
+     * The qs library defaults to 20 to prevent DoS attacks with large array indices.
+     * Set this to a higher value if your API needs to handle more than 20 array items.
+     *
+     * @default 20
+     * @see https://github.com/ljharb/qs#parsing-arrays
+     */
+    arrayLimit?: number;
+  };
   sequence?: Constructor<SequenceHandler>;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   expressSettings: {[name: string]: any};