Make cleaning of request params profile-dependent

as suggested by @martenson

lib/galaxy/tool_util/xsd/galaxy.xsd

@@ -68,6 +68,7 @@ List of behavior changes associated with profile versions:
 ### 24.0
 
 - Do not use Galaxy python environment for `data_source_async` tools.
+- Drop request parameters received by data source tools that are not declared in `<request_param_translation>` section.
 
 ### Examples
 

lib/galaxy/tools/__init__.py

@@ -2895,6 +2895,13 @@ class DataSourceTool(OutputParameterJSONTool):
     tool_type = "data_source"
     default_tool_action = DataSourceToolAction
 
+    @property
+    def wants_params_cleaned(self):
+        """Indicates whether received, but undeclared request params should be cleaned."""
+        if self.profile < 24.0:
+            return False
+        return True
+
     def _build_GALAXY_URL_parameter(self):
         return ToolParameter.build(
             self, XML(f'<param name="GALAXY_URL" type="baseurl" value="/tool_runner?tool_id={self.id}" />')

lib/galaxy/webapps/galaxy/controllers/async.py

@@ -86,7 +86,7 @@ def index(self, trans, tool_id=None, data_secret=None, **kwd):
                     translator.galaxy_name for translator in tool.input_translator.param_trans_dict.values()
                 }
                 for param in params:
-                    if param in tool_declared_params:
+                    if param in tool_declared_params or not tool.wants_params_cleaned:
                         params_dict[param] = params.get(param, None)
             params = params_dict
 

lib/galaxy/webapps/galaxy/controllers/tool_runner.py

@@ -93,7 +93,7 @@ def __tool_404__():
             # preserve original params sent by the remote server as extra dict
             # before in-place translation happens, then clean the incoming params
             params.update({"incoming_request_params": params.copy()})
-            if tool.input_translator:
+            if tool.input_translator and tool.wants_params_cleaned:
                 for k in list(params.keys()):
                     if k not in tool.input_translator.vocabulary and k not in ("URL", "incoming_request_params"):
                         # the remote server has sent a param