Do not mutate user-supplied opts

lib/makeRequest.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const utils = require('./utils');
+const cloneDeep = require('lodash.clonedeep');
 
 function getRequestOpts(self, requestArgs, spec, overrideData) {
   // Extract spec values with defaults.
@@ -30,12 +31,15 @@ function getRequestOpts(self, requestArgs, spec, overrideData) {
   // Pull request data and options (headers, auth) from args.
   const dataFromArgs = utils.getDataFromArgs(args);
   const data = encode(Object.assign({}, dataFromArgs, overrideData));
-  const options = utils.getOptionsFromArgs(args);
+
+  // At this point, args has been mutated. Deep-copy to prevent further mutations.
+  const restOfArgs = cloneDeep(args);
+  const options = utils.getOptionsFromArgs(restOfArgs);
 
   // Validate that there are no more args.
-  if (args.filter((x) => x != null).length) {
+  if (restOfArgs.filter((x) => x != null).length) {
     throw new Error(
-      `Stripe: Unknown arguments (${args}). Did you mean to pass an options object? See https://github.com/stripe/stripe-node/wiki/Passing-Options. (on API request to ${requestMethod} \`${path}\`)`
+      `Stripe: Unknown arguments (${restOfArgs}). Did you mean to pass an options object? See https://github.com/stripe/stripe-node/wiki/Passing-Options. (on API request to ${requestMethod} \`${path}\`)`
     );
   }
 

package.json

@@ -45,6 +45,7 @@
   },
   "dependencies": {
     "@types/node": ">=8.1.0",
+    "lodash.clonedeep": "^4.5.0",
     "qs": "^6.6.0"
   },
   "license": "MIT",

test/makeRequest.spec.js

@@ -0,0 +1,29 @@
+'use strict';
+
+require('../testUtils');
+
+const makeRequest = require('../lib/makeRequest');
+const expect = require('chai').expect;
+
+describe('makeRequest', () => {
+  describe('args', () => {
+    it('does not mutate user-supplied deprecated opts', () => {
+      const args = [
+        {
+          stripe_account: 'bad',
+        },
+      ];
+      const mockSelf = {
+        createResourcePathWithSymbols: () => {},
+        createFullPath: () => {},
+        _request: () => {},
+      };
+      makeRequest(mockSelf, args, {}, {});
+      expect(args).to.deep.equal([
+        {
+          stripe_account: 'bad',
+        },
+      ]);
+    });
+  });
+});

yarn.lock

@@ -1392,6 +1392,11 @@ locate-path@^3.0.0:
     p-locate "^3.0.0"
     path-exists "^3.0.0"
 
+lodash.clonedeep@^4.5.0:
+  version "4.5.0"
+  resolved "https://registry.yarnpkg.com/lodash.clonedeep/-/lodash.clonedeep-4.5.0.tgz#e23f3f9c4f8fbdde872529c1071857a086e5ccef"
+  integrity sha1-4j8/nE+Pvd6HJSnBBxhXoIblzO8=
+
 lodash.flattendeep@^4.4.0:
   version "4.4.0"
   resolved "https://registry.yarnpkg.com/lodash.flattendeep/-/lodash.flattendeep-4.4.0.tgz#fb030917f86a3134e5bc9bec0d69e0013ddfedb2"