[BUG] [typescript-axios] URL search parameters include global object functions

Bug Report Checklist

• Have you provided a full/minimal spec to reproduce the issue?
• Have you validated the input using an OpenAPI validator (example)?
• Have you tested with the latest master to confirm the issue still exists?
• Have you searched for related issues/PRs?
• What's the actual output vs expected output?
• [Optional] Sponsorship to speed up the bug fix or feature request (example)

Description

Serialization of URL search parameters uses the for...in loop including prototype properties.

Extensions of the global object prototype (e. g. done by scope-extension.js are interpreted as object keys within common.ts/setSearchParams and therefore set as search parameters.

Example: ?specifiedParam=true&let=function+%28block%29+%7B%0A++++return+block%28this%29%3B%0A%7D&also=function+%28block%29+%7B%0A++++block%28this%29%3B%0A++++return+this%3B%0A%7D&run=function+%28block%29+%7B%0A++++return+block.call%28this%29%3B%0A%7D&apply=function+%28block%29+%7B%0A++++block.call%28this%29%3B%0A++++return+this%3B%0A%7D&takeIf=function+%28predicate%29+%7B%0A++++return+predicate%28this%29+%3F+this+%3A+undefined%3B%0A%7D&takeUnless=function+%28predicate%29+%7B%0A++++return+predicate%28this%29+%3F+undefined+%3A+this%3B%0A%7D

Solution: Object.keys excludes prototype properties.

openapi-generator version

5.4.0

Generation Details

Steps to reproduce

• use any generated code with URL parameters
• extend the global object protype, e. g. by importing scope-extension.js
• send the request

Related issues/PRs

none found

Suggest a fix

common.mustach line 82:
for (const key in Object.keys(object)) { ... }

Inspect common.mustach at line 82 and trace how generated TypeScript Axios clients serialize URL search parameters. Reproduce with an extended global object prototype, then verify that generated requests include only the object's own parameters and no prototype functions.