From b013507a2e7b95780a6abd821b2955c97c8298fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rmungandrk?= <github@zerodaysec.org>
Date: Fri, 31 Oct 2025 19:44:45 +0700
Subject: [PATCH] fix(mockotlpserver): validate dynamic action names and guard
 calls

---
 packages/mockotlpserver/lib/http.js | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/packages/mockotlpserver/lib/http.js b/packages/mockotlpserver/lib/http.js
index df8e7d68..2093a8dc 100644
--- a/packages/mockotlpserver/lib/http.js
+++ b/packages/mockotlpserver/lib/http.js
@@ -225,7 +225,15 @@ class HttpService extends Service {
                 // same context).
                 // https://nodejs.org/api/diagnostics_channel.html#channelpublishmessage
                 // TODO: maybe surround with try/catch to not blow up the server?
-                const parseData = parsersMap[contentType] || unknownParser;
+                let parseData;
+                if (
+                    Object.prototype.hasOwnProperty.call(parsersMap, contentType) &&
+                    typeof parsersMap[contentType] === 'function'
+                ) {
+                    parseData = parsersMap[contentType];
+                } else {
+                    parseData = unknownParser;
+                }
                 const reqBuffer = Buffer.concat(chunks);
                 const reqUrl = req.url;
                 const data = parseData(log, reqBuffer, req);