feat(bson-parsing): restrict web worker scope COMPASS-11128

[mabaasit]

Description

COMPASS-11128

Open Questions

Checklist

• I have signed the Contributor License Agreement (https://www.mongodb.com/legal/contributor-agreement)
• New tests and/or benchmarks are included
• Documentation is changed or added

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[addaleax]

Adding const { self, onmessage, postMessage } = globalThis; above this statement should remove this requirement, and we do want to avoid a situation where the "sandbox" could call postMessage()

[mabaasit]

Yes, that's much better and will clean this up

[addaleax]

Buffer is a Node.js concept, do we need that?

[addaleax]

Object.prototype.constructor is part of standard JS, why are we excluding that?

[Copilot]

Copilot review overview

🟡 Changes recommended

The worker response callback can break, and test environment cleanup is incorrect.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Preserve postMessage when restricting worker global scope · New

What changed in this PR

This pull request hardens the BSON parser web worker by restricting its scope and expanding worker tests.

Changes:

• Restricts worker globals and prototypes.
• Supports direct worker URLs in tests.
• Adds worker lifecycle and security coverage.

File	Summary
packages/​shell-bson-parser/​src/​worker.ts	Restricts worker capabilities. Critical (3 votes): postMessage must remain available.
packages/​shell-bson-parser/​src/​worker-client.ts	Adds test worker URL handling.
packages/​shell-bson-parser/​src/​index.spec.ts	Expands worker behavior tests. Moderate (1 vote): delete the environment variable instead of assigning undefined.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.