fix(eval): preserve sibling params when Filepicker Binary data is passed to action run (#42021)

## Description

Filepicker Binary-format data passed alongside other params to
`Api.run()` caused **every sibling param to become `null`** and
`{{this.params}}` to become `null`.

**Reproduce:** Filepicker with Data Format = Binary, then
```js
await Api1.run({ name: "Test", sources: Filepicker1.files })
```
`name` arrives as `null` (and `this.params` is `null`). Base64 format
and the no-file case work fine.

**Root cause:** `DataTreeEvaluator.evaluateActionBindings` serialized
the whole params object into a single `{{
${JSON.stringify(executionParams)} }}` binding and re-parsed it with the
brace-counting `getDynamicStringSegments`. Filepicker Binary data is a
raw `readAsBinaryString` byte string that routinely contains unescaped
`{`/`}` bytes; `JSON.stringify` does not escape braces, so the counter
unbalances and the **entire** params object collapses to `undefined`.
Base64 works because its alphabet has no braces.

**Fix:** `JSON.stringify` emits only literals, so that round-trip could
only deep-clone the (already fully-evaluated) params — it never resolved
nested bindings. Replace it with the already-imported JSON-safe deep
clone `klonaJSON(executionParams)`. This is behavior-preserving for
valid cases, faithfully passes JS values through, avoids re-serializing
multi-MB binary payloads, and removes the brace vulnerability entirely.

**Reviewer notes:**
- Intentional (more-faithful) behavior change now covered by tests:
`undefined`/`NaN`/`Date` param values pass through unnormalized instead
of being JSON-coerced.
- `generateOverrideContext` already receives the raw `executionParams`
object, so its (EE) contract is unchanged.
- Verified red→green: on the old code the regression test returns
all-`undefined` params (the exact bug); on the fix all
`evaluateActionBindings` tests pass.

**TL;DR:** Filepicker Binary data in `Api.run()` params no longer nulls
out the other params — the params object is now deep-cloned instead of
round-tripped through the `{{ }}` binding parser.

Fixes appsmithorg/appsmith-ee#8639

## Automation

/ok-to-test tags="@tag.All"

### 🔍 Cypress test results
<!-- This is an auto-generated comment: Cypress test results  -->
> [!TIP]
> 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
> Workflow run:
<https://github.com/appsmithorg/appsmith/actions/runs/30824007861>
> Commit: f7bae03
> <a
href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=30824007861&attempt=1"
target="_blank">Cypress dashboard</a>.
> Tags: `@tag.All`
> Spec:
> <hr>Mon, 03 Aug 2026 15:45:44 UTC
<!-- end of auto-generated comment: Cypress test results  -->

## Communication
Should the DevRel and Marketing teams inform users about this change?
- [ ] Yes
- [x] No


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed action parameter evaluation when values contain unbalanced
braces, preserving sibling parameters and correct results.
* Prevented already-evaluated parameters from being altered through
template parsing or type conversion.
* Improved handling of execution parameter references during dynamic
value evaluation.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: sebastianiv21

app/client/src/workers/common/DataTreeEvaluator/dataTreeEvaluator.test.ts

@@ -160,6 +160,41 @@ describe("DataTreeEvaluator", () => {
       ]);
     });
 
+    // Regression for #8639: Filepicker Binary data (a raw byte string containing
+    // '{'/'}' chars) in one param must not corrupt sibling params. Previously the
+    // whole params object was round-tripped through the {{ }} brace-counting parser,
+    // so unbalanced braces in the binary value nulled out every other param.
+    it("preserves sibling params when a param value contains unbalanced braces", () => {
+      // Mimics a Filepicker "Binary" readAsBinaryString payload: raw bytes incl.
+      // unbalanced braces, a null byte and a high byte (kept as \u escapes so the
+      // source file stays ASCII and is not treated as binary).
+      const binaryLike = ' {"junk": "}}{{" } \u0000\u00ff';
+      const result = dataTreeEvaluator.evaluateActionBindings(
+        ["this.params.name", "this.params.sources", "executionParams.name"],
+        {
+          name: "Test",
+          sources: binaryLike,
+        },
+      );
+
+      expect(result).toStrictEqual(["Test", binaryLike, "Test"]);
+    });
+
+    // Locks the intended behavior change from the #8639 fix: params are cloned, not
+    // re-evaluated/JSON-normalized. A value that looks like a binding is preserved
+    // verbatim, and NaN survives (the old JSON.stringify round-trip coerced it to null).
+    it("passes already-evaluated params through verbatim", () => {
+      const result = dataTreeEvaluator.evaluateActionBindings(
+        ["this.params.binding", "this.params.notANumber"],
+        {
+          binding: "{{Api1.data}}",
+          notANumber: NaN,
+        },
+      );
+
+      expect(result).toStrictEqual(["{{Api1.data}}", NaN]);
+    });
+
     // The test should verify that generateOverrideContext is called and passed as context to getDynamicValue
     it("should call generateOverrideContext and pass as context to getDynamicValue", () => {
       const overrideContextValue = { "ModuleInstance1.inputs.input1": "200" };
@@ -242,36 +277,30 @@ describe("DataTreeEvaluator", () => {
         "200",
       ]);
 
-      // Verify getDynamicValue receives the correct parameters
-      // The first call is always with executionParams
-      [`${JSON.stringify(executionParams)}`, ...bindings].forEach(
-        (binding, index) => {
-          const replacedBinding = binding.replace(
-            EXECUTION_PARAM_REFERENCE_REGEX,
-            EXECUTION_PARAM_KEY,
-          );
+      // Verify getDynamicValue receives the correct parameters.
+      // Execution params are now cloned directly (no {{ }} round-trip), so there is
+      // no leading getDynamicValue call for them — only one call per binding, each
+      // carrying the overrideContext.
+      bindings.forEach((binding, index) => {
+        const replacedBinding = binding.replace(
+          EXECUTION_PARAM_REFERENCE_REGEX,
+          EXECUTION_PARAM_KEY,
+        );
 
-          let defaultExpectedValue = [
-            `{{${replacedBinding}}}`,
-            klona(dataTree),
-            dataTreeEvaluator.oldConfigTree,
-            EvaluationSubstitutionType.TEMPLATE,
-          ];
-
-          if (index !== 0) {
-            defaultExpectedValue = [
-              ...defaultExpectedValue,
-              expect.objectContaining({
-                overrideContext: overrideContextValue,
-              }),
-            ];
-          }
-
-          expect(getDynamicValueCapturedParams[index]).toEqual(
-            defaultExpectedValue,
-          );
-        },
-      );
+        const defaultExpectedValue = [
+          `{{${replacedBinding}}}`,
+          klona(dataTree),
+          dataTreeEvaluator.oldConfigTree,
+          EvaluationSubstitutionType.TEMPLATE,
+          expect.objectContaining({
+            overrideContext: overrideContextValue,
+          }),
+        ];
+
+        expect(getDynamicValueCapturedParams[index]).toEqual(
+          defaultExpectedValue,
+        );
+      });
 
       // Restore the original function after the test
       (generateOverrideContext as jest.Mock).mockImplementation(

app/client/src/workers/common/DataTreeEvaluator/index.ts

@@ -2069,12 +2069,11 @@ export default class DataTreeEvaluator {
     let overrideContext: Record<string, unknown>;
 
     if (executionParams && isObject(executionParams)) {
-      evaluatedExecutionParams = this.getDynamicValue(
-        `{{${JSON.stringify(executionParams)}}}`,
-        this.evalTree,
-        this.oldConfigTree,
-        EvaluationSubstitutionType.TEMPLATE,
-      );
+      // Execution params are already fully-evaluated JS values here, so a JSON-safe
+      // deep clone is sufficient. Do NOT route them back through the {{ }} template
+      // parser: Filepicker Binary data can contain '{'/'}' bytes that unbalance the
+      // brace counter in getDynamicStringSegments and null out sibling params. (#8639)
+      evaluatedExecutionParams = klonaJSON(executionParams);
 
       overrideContext = generateOverrideContext({
         bindings,