Avoid mutating the static context, and isolate the static context objects

.changeset/itchy-cats-hang.md

@@ -0,0 +1,7 @@
+---
+'@whatwg-node/server': patch
+---
+
+Avoid mutating the static context
+
+For example if the adapter receives the server object as the server context, it is isolated and the handler cannot mutate it, otherwise it will leak. Bun does that so this patch is needed to avoid leaking the server object.

packages/server/src/createServerAdapter.ts

@@ -19,6 +19,7 @@ import {
   handleErrorFromRequestHandler,
   isFetchEvent,
   isNodeRequest,
+  isolateObject,
   isPromise,
   isRequestInit,
   isServerResponse,
@@ -282,7 +283,7 @@ function createServerAdapter<
   }
 
   function handleRequestWithWaitUntil(request: Request, ...ctx: Partial<TServerContext>[]) {
-    const serverContext = (ctx.length > 1 ? completeAssign(...ctx) : ctx[0]) || {};
+    const serverContext = ctx.length > 1 ? completeAssign(...ctx) : isolateObject(ctx[0]);
     if (serverContext.waitUntil == null) {
       const waitUntilPromises: Promise<void>[] = [];
       addWaitUntil(serverContext, waitUntilPromises);

packages/server/src/utils.ts

@@ -443,3 +443,65 @@ export function handleErrorFromRequestHandler(error: any, ResponseCtor: typeof R
     status: error.status || 500,
   });
 }
+
+export function isolateObject<TIsolatedObject extends object>(
+  originalCtx: TIsolatedObject,
+): TIsolatedObject {
+  if (originalCtx == null) {
+    return {} as TIsolatedObject;
+  }
+  const extraProps: Partial<TIsolatedObject> = {};
+  const deletedProps = new Set<string | symbol>();
+  return new Proxy(originalCtx, {
+    get(originalCtx, prop, receiver) {
+      if (prop in extraProps) {
+        return Reflect.get(extraProps, prop, receiver);
+      }
+      if (deletedProps.has(prop)) {
+        return undefined;
+      }
+      if (prop in originalCtx) {
+        return Reflect.get(originalCtx, prop, receiver);
+      }
+    },
+    set(_originalCtx, prop, value, receiver) {
+      return Reflect.set(extraProps, prop, value, receiver);
+    },
+    has(originalCtx, prop) {
+      if (deletedProps.has(prop)) {
+        return false;
+      }
+      if (prop in extraProps) {
+        return true;
+      }
+      return Reflect.has(originalCtx, prop);
+    },
+    defineProperty(_originalCtx, prop, descriptor) {
+      return Reflect.defineProperty(extraProps, prop, descriptor);
+    },
+    deleteProperty(_originalCtx, prop) {
+      if (prop in extraProps) {
+        return Reflect.deleteProperty(extraProps, prop);
+      }
+      deletedProps.add(prop);
+      return true;
+    },
+    ownKeys(originalCtx) {
+      const extraKeys = Reflect.ownKeys(extraProps);
+      const originalKeys = Reflect.ownKeys(originalCtx);
+      const deletedKeys = Array.from(deletedProps);
+      return Array.from(
+        new Set(extraKeys.concat(originalKeys.filter(keys => !deletedKeys.includes(keys)))),
+      );
+    },
+    getOwnPropertyDescriptor(originalCtx, prop) {
+      if (prop in extraProps) {
+        return Reflect.getOwnPropertyDescriptor(extraProps, prop);
+      }
+      if (deletedProps.has(prop)) {
+        return undefined;
+      }
+      return Reflect.getOwnPropertyDescriptor(originalCtx, prop);
+    },
+  });
+}

packages/server/test/server-context.spec.ts

@@ -0,0 +1,23 @@
+import { createServerAdapter } from '../src/createServerAdapter';
+
+describe('Server Context', () => {
+  it('should be passed to the handler', async () => {
+    const exampleStaticCtx = { foo: 'bar' };
+    const seenCtx = new Set();
+    const adapter = createServerAdapter<typeof exampleStaticCtx>(function handler(_req, ctx) {
+      seenCtx.add(ctx);
+      ctx.foo = 'baz';
+      return new Response('ok');
+    });
+    const res = await adapter(new Request('https://example.com'), exampleStaticCtx);
+    expect(res.status).toBe(200);
+    expect(seenCtx.size).toBe(1);
+    expect(seenCtx.has(exampleStaticCtx)).toBe(false);
+    expect(exampleStaticCtx.foo).toBe('bar');
+    const res2 = await adapter(new Request('https://example.com'), exampleStaticCtx);
+    expect(res2.status).toBe(200);
+    expect(seenCtx.size).toBe(2);
+    expect(seenCtx.has(exampleStaticCtx)).toBe(false);
+    expect(exampleStaticCtx.foo).toBe('bar');
+  });
+});