Merge pull request #881 from stephenplusplus/spp--datastore-multiple-…

…entities

datastore: prevent manipulating user input during save

lib/datastore/request.js

@@ -384,6 +384,8 @@ DatastoreRequest.prototype.save = function(entities, callback) {
 
   var req = {
     mutation: entities.reduce(function(acc, entityObject, index) {
+      entityObject = extend(true, {}, entityObject);
+
       var ent = {};
       var method = entityObject.method;
       delete entityObject.method;

test/datastore/request.js

@@ -455,6 +455,32 @@ describe('Request', function() {
       ], done);
     });
 
+    it('should not alter the provided data object', function(done) {
+      var entities = [
+        {
+          key: key,
+          method: 'insert',
+          indexed: false,
+          data: {
+            value: {
+              a: 'b',
+              c: [1, 2, 3]
+            }
+          }
+        }
+      ];
+      var expectedEntities = extend(true, {}, entities);
+
+      request.makeReq_ = function() {
+        // By the time the request is made, the original object has already been
+        // transformed into a raw request.
+        assert.deepEqual(entities, expectedEntities);
+        done();
+      };
+
+      request.save(entities, assert.ifError);
+    });
+
     it('should return apiResponse in callback', function(done) {
       var key = new entity.Key({ namespace: 'ns', path: ['Company'] });
       var mockCommitResponse = {