fix(rest): apply queryParser.arrayLimit as opt-in to preserve default behavior

Signed-off-by: kauanAfonso <kauan.afonso@ibm.com>

Author: kauanAfonso

packages/rest/src/__tests__/acceptance/request-parsing/array-limit.acceptance.ts

@@ -19,9 +19,15 @@ describe('Query parameter array limit', () => {
     if (app) await app.stop();
   });
 
-  context('with default arrayLimit (30)', () => {
+  context('with custom arrayLimit (30)', () => {
     beforeEach(async () => {
-      app = givenApplication();
+      app = givenApplication({
+        rest: {
+          queryParser: {
+            arrayLimit: 30,
+          },
+        },
+      });
       await app.start();
       client = createRestAppClient(app);
     });
@@ -43,7 +49,7 @@ describe('Query parameter array limit', () => {
       expect(Array.isArray(response.body.ids)).to.be.true();
     });
 
-    it('converts arrays with 31+ items to objects (exceeds default limit)', async () => {
+    it('converts arrays with 31+ items to objects (exceeds limit)', async () => {
       const ids = Array.from({length: 31}, (_, i) => (i + 1).toString());
       const query = ids.map(id => `ids=${id}`).join('&');
 

packages/rest/src/rest.server.ts

@@ -329,16 +329,17 @@ export class RestServer
       this._expressApp.set('strict routing', this.config.router.strict);
     }
 
-    // Configure query parser with custom arrayLimit if provided
-    const arrayLimit = this.config.queryParser?.arrayLimit ?? 30;
-    this._expressApp.set('query parser', (str: string) => {
-      return qs.parse(str, {
-        arrayLimit,
-        // Use extended mode (same as body-parser urlencoded)
-        allowPrototypes: false,
-        depth: 20,
+    if (this.config.queryParser?.arrayLimit !== undefined) {
+      const arrayLimit = this.config.queryParser.arrayLimit;
+
+      this._expressApp.set('query parser', (str: string) => {
+        return qs.parse(str, {
+          arrayLimit,
+          allowPrototypes: false,
+          depth: 20,
+        });
       });
-    });
+    }
   }
 
   /**
@@ -1198,10 +1199,10 @@ export interface RestServerResolvedOptions {
   queryParser?: {
     /**
      * Maximum number of array elements to parse in query parameters.
+     * When not configured, Express uses its default query parser.
      * The qs library defaults to 20 to prevent DoS attacks with large array indices.
      * Set this to a higher value if your API needs to handle more than 20 array items.
      *
-     * @default 30
      * @see https://github.com/ljharb/qs#parsing-arrays
      */
     arrayLimit?: number;