Defensive Programming: The Hidden Dangers of Spread Operators in Request Payloads

// ❌ Dangerous: Using spread operator for payload construction
const createUserPayload = {
  ...userFormData,        // Contains: name, email, age, debugInfo, internalFlags
  ...additionalData,      // Contains: preferences, metadata, tempId
  ...featureFlags,        // Contains: enableBeta, debugMode, adminAccess
  operation: 'CREATE_USER'
}

// Send to GraphQL API
const result = await graphqlClient.mutate({
  mutation: CREATE_USER_MUTATION,
  variables: { input: createUserPayload }
})

# GraphQL Schema only accepts these fields:
input CreateUserInput {
  name: String!
  email: String!
  age: Int
  preferences: UserPreferences
  operation: String!
}

GraphQL Error: Field "debugInfo" is not defined by type "CreateUserInput"
GraphQL Error: Field "internalFlags" is not defined by type "CreateUserInput"  
GraphQL Error: Field "tempId" is not defined by type "CreateUserInput"
GraphQL Error: Field "debugMode" is not defined by type "CreateUserInput"
GraphQL Error: Field "adminAccess" is not defined by type "CreateUserInput"

interface UserFormData {
  name: string
  email: string
  age: number
  // TypeScript doesn't know about these at compile time:
  [key: string]: any  // Index signature allows anything
}

interface CreateUserInput {
  name: string
  email: string
  age?: number
  operation: string
}

// ❌ TypeScript allows this, but it's dangerous
const payload: CreateUserInput = {
  ...userFormData,  // May contain extra fields
  operation: 'CREATE_USER'
}
// No compile-time error, but runtime failure guaranteed

// ❌ Common anti-pattern that defeats TypeScript's safety
interface FormData {
  [key: string]: any  // This disables type checking
}

// ❌ Or using 'any' type
const buildPayload = (data: any) => ({
  ...data,
  timestamp: Date.now()
})

// ❌ Development debug info accidentally sent to production
const orderPayload = {
  ...orderData,
  ...debugInfo,  // Contains: userId, sessionId, internalNotes
  ...{
    // Development-only fields that shouldn't reach production
    debugTimestamp: Date.now(),
    developerNotes: 'Testing checkout flow',
    internalCustomerId: 'dev_12345'
  }
}

// ❌ User input accidentally includes admin fields
const userInput = {
  name: 'John Doe',
  email: 'john@example.com',
  // Malicious user adds these fields:
  isAdmin: true,
  permissions: ['DELETE_USERS', 'ACCESS_ADMIN_PANEL'],
  role: 'SUPER_ADMIN'
}

const updateUserPayload = {
  ...userInput,  // Blindly spreads potentially malicious data
  updatedAt: new Date()
}

// ❌ Old code breaks when API schema changes
const legacyPayload = {
  ...oldUserData,     // Contains deprecated fields
  ...newFeatureData,  // Contains fields not yet in schema
  ...experimentalData // Contains A/B test fields
}

// API schema removed 'legacyField' and doesn't recognize 'experimentalField'
// Result: Runtime errors in production

import { pick } from 'ramda'

// ✅ Safe: Explicitly define allowed fields
const ALLOWED_USER_FIELDS = [
  'name',
  'email', 
  'age',
  'preferences'
] as const

const createUserPayload = {
  ...pick(ALLOWED_USER_FIELDS, userFormData),
  operation: 'CREATE_USER'
}

// Only specified fields are included, everything else is filtered out

// ✅ Define strict interfaces without index signatures
interface CreateUserInput {
  readonly name: string
  readonly email: string
  readonly age?: number
  readonly preferences?: UserPreferences
  readonly operation: 'CREATE_USER'
}

// ✅ Builder pattern for safe construction
class UserPayloadBuilder {
  private payload: Partial<CreateUserInput> = {}

  setName(name: string): this {
    this.payload.name = name
    return this
  }

  setEmail(email: string): this {
    this.payload.email = email
    return this
  }

  setAge(age: number): this {
    this.payload.age = age
    return this
  }

  build(): CreateUserInput {
    if (!this.payload.name || !this.payload.email) {
      throw new Error('Name and email are required')
    }

    return {
      name: this.payload.name,
      email: this.payload.email,
      age: this.payload.age,
      preferences: this.payload.preferences,
      operation: 'CREATE_USER'
    }
  }
}

// Usage
const payload = new UserPayloadBuilder()
  .setName(userFormData.name)
  .setEmail(userFormData.email)
  .setAge(userFormData.age)
  .build()

// ✅ Type-safe field extraction
const extractUserFields = (data: unknown): CreateUserInput => {
  if (!isValidUserData(data)) {
    throw new Error('Invalid user data')
  }

  return {
    name: data.name,
    email: data.email,
    age: data.age,
    preferences: data.preferences,
    operation: 'CREATE_USER'
  }
}

// Type guard function
function isValidUserData(data: any): data is {
  name: string
  email: string
  age?: number
  preferences?: UserPreferences
} {
  return (
    typeof data === 'object' &&
    typeof data.name === 'string' &&
    typeof data.email === 'string' &&
    (data.age === undefined || typeof data.age === 'number')
  )
}

import { pick, omit } from 'ramda'

// ✅ Multiple layers of defense
const buildSafePayload = (rawData: Record<string, any>) => {
  // Layer 1: Remove known dangerous fields
  const withoutDangerousFields = omit([
    'debugInfo',
    'internalFlags', 
    'adminAccess',
    'isAdmin',
    'permissions',
    'sessionId',
    'authToken'
  ], rawData)

  // Layer 2: Only include allowed fields
  const allowedFields = pick([
    'name',
    'email',
    'age',
    'preferences'
  ], withoutDangerousFields)

  // Layer 3: Explicit construction with validation
  return {
    name: String(allowedFields.name || '').trim(),
    email: String(allowedFields.email || '').toLowerCase().trim(),
    age: typeof allowedFields.age === 'number' ? allowedFields.age : undefined,
    preferences: allowedFields.preferences || {},
    operation: 'CREATE_USER' as const
  }
}

// ❌ Performance issues with large objects
const hugeObject = { /* 10,000 properties */ }
const anotherHugeObject = { /* 10,000 properties */ }

// Creates new object with 20,000 properties - expensive!
const combined = {
  ...hugeObject,
  ...anotherHugeObject,
  newField: 'value'
}

// ✅ Better: Only pick what you need
const optimized = {
  ...pick(['field1', 'field2', 'field3'], hugeObject),
  ...pick(['field4', 'field5'], anotherHugeObject),
  newField: 'value'
}

// ❌ Memory inefficient
const createPayloads = (users: User[]) => {
  return users.map(user => ({
    ...user,           // Copies all user fields (potentially 50+ fields)
    ...user.profile,   // Copies all profile fields (potentially 30+ fields)  
    ...user.settings,  // Copies all settings (potentially 20+ fields)
    timestamp: Date.now()
  }))
}

// ✅ Memory efficient
const createOptimizedPayloads = (users: User[]) => {
  return users.map(user => ({
    id: user.id,
    name: user.name,
    email: user.email,
    avatar: user.profile?.avatar,
    theme: user.settings?.theme,
    timestamp: Date.now()
  }))
}

import fc from 'fast-check'

// ✅ Test with random malicious inputs
describe('Payload sanitization', () => {
  it('should handle arbitrary malicious input', () => {
    fc.assert(
      fc.property(
        fc.record({
          // Valid fields
          name: fc.string(),
          email: fc.emailAddress(),
          // Malicious fields
          isAdmin: fc.boolean(),
          deleteAllUsers: fc.boolean(),
          __proto__: fc.anything(),
          constructor: fc.anything()
        }),
        (maliciousInput) => {
          const sanitized = buildSafePayload(maliciousInput)

          // Should only contain allowed fields
          expect(Object.keys(sanitized)).toEqual(['name', 'email', 'operation'])

          // Should not contain dangerous fields
          expect(sanitized).not.toHaveProperty('isAdmin')
          expect(sanitized).not.toHaveProperty('deleteAllUsers')
          expect(sanitized).not.toHaveProperty('__proto__')
        }
      )
    )
  })
})

describe('Security tests', () => {
  it('should prevent prototype pollution', () => {
    const maliciousPayload = {
      name: 'John',
      email: 'john@example.com',
      '__proto__': { isAdmin: true },
      'constructor': { prototype: { isAdmin: true } }
    }

    const sanitized = buildSafePayload(maliciousPayload)

    expect(sanitized.isAdmin).toBeUndefined()
    expect(Object.prototype.isAdmin).toBeUndefined()
  })

  it('should handle deeply nested malicious objects', () => {
    const deepMalicious = {
      name: 'John',
      preferences: {
        theme: 'dark',
        admin: {
          deleteUsers: true,
          accessLevel: 'SUPER_ADMIN'
        }
      }
    }

    const sanitized = buildSafePayload(deepMalicious)

    expect(sanitized.preferences?.admin).toBeUndefined()
  })
})