orca/docs/site/tests/zod-security.test.mjs

import assert from 'node:assert/strict'
import { createRequire } from 'node:module'
import { dirname, join } from 'node:path'
import test from 'node:test'
import { pathToFileURL } from 'node:url'

const require = createRequire(import.meta.url)
const vercelRequire = createRequire(require.resolve('vercel/package.json'))
const backendsRequire = createRequire(vercelRequire.resolve('@vercel/backends/package.json'))
const zodRoot = dirname(backendsRequire.resolve('zod/package.json'))

for (const extension of ['cjs', 'js']) {
  for (const entry of ['index', 'v3/index', 'v4/index']) {
    test(`Vercel Zod rejects oversized collections before parsing elements (${entry}.${extension})`, async () => {
      const path = join(zodRoot, `${entry}.${extension}`)
      const z = extension === 'cjs' ? require(path) : await import(pathToFileURL(path).href)
      let parsed = 0
      const element = z.preprocess((value) => {
        parsed += 1
        return value
      }, z.string())
      for (const [schema, value, valid] of [
        [z.array(element).max(2), Array(1_000).fill(0), ['a']],
        [z.array(element).length(2), Array(1_000).fill(0), ['a', 'b']],
        [z.set(element).max(2), new Set([1, 2, 3]), new Set(['a'])],
        [z.set(element).size(2), new Set([1, 2, 3]), new Set(['a', 'b'])]
      ]) {
        parsed = 0
        for (const result of [schema.safeParse(value), await schema.safeParseAsync(value)]) {
          assert.equal(result.success, false)
          assert.deepEqual(
            result.error.issues.map((issue) => issue.code),
            ['too_big']
          )
        }
        assert.equal(parsed, 0)
        assert.deepEqual(schema.parse(valid), valid)
        assert.deepEqual(await schema.parseAsync(valid), valid)
      }
    })
  }
}

test('docs Zod 4 keeps valid schemas working after the security upgrade', async () => {
  const { z } = await import('zod')
  const schema = z.array(z.string()).max(2)
  assert.deepEqual(schema.parse(['a']), ['a'])
  assert.deepEqual(
    schema.safeParse([1, 2, 3]).error.issues.map((issue) => issue.code),
    ['too_big']
  )
})