@graphql-tools/delegate 10.2.10 → 10.2.11-alpha-117d5221fdd40912b571f033539fcea93e434d3d
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/dist/index.cjs +11 -1
- package/dist/index.d.cts +6 -2
- package/dist/index.d.ts +6 -2
- package/dist/index.js +11 -2
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,11 @@
|
|
|
1
1
|
# @graphql-tools/delegate
|
|
2
2
|
|
|
3
|
+
## 10.2.11-alpha-117d5221fdd40912b571f033539fcea93e434d3d
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- [#506](https://github.com/graphql-hive/gateway/pull/506) [`a2842ab`](https://github.com/graphql-hive/gateway/commit/a2842ab8177d08b0c6cc72fa94b4a2f05857cd57) Thanks [@ardatan](https://github.com/ardatan)! - Add `isPrototypePollutingKey` to prevent accidential prototype pollution
|
|
8
|
+
|
|
3
9
|
## 10.2.10
|
|
4
10
|
|
|
5
11
|
### Patch Changes
|
package/dist/index.cjs
CHANGED
|
@@ -57,6 +57,15 @@ class Subschema {
|
|
|
57
57
|
}
|
|
58
58
|
}
|
|
59
59
|
|
|
60
|
+
const prototypePollutingKeys = [
|
|
61
|
+
"__proto__",
|
|
62
|
+
"constructor",
|
|
63
|
+
"prototype"
|
|
64
|
+
];
|
|
65
|
+
function isPrototypePollutingKey(key) {
|
|
66
|
+
return prototypePollutingKeys.includes(key);
|
|
67
|
+
}
|
|
68
|
+
|
|
60
69
|
const leftOverByDelegationPlan = /* @__PURE__ */ new WeakMap();
|
|
61
70
|
const PLAN_LEFT_OVER = Symbol("PLAN_LEFT_OVER");
|
|
62
71
|
function getPlanLeftOverFromParent(parent) {
|
|
@@ -167,7 +176,7 @@ function handleResolverResult(resolverResult, subschema, selectionSet, object, c
|
|
|
167
176
|
const objectSubschema = resolverResult[OBJECT_SUBSCHEMA_SYMBOL];
|
|
168
177
|
const fieldSubschemaMap = resolverResult[FIELD_SUBSCHEMA_MAP_SYMBOL];
|
|
169
178
|
for (const responseKey in resolverResult) {
|
|
170
|
-
if (responseKey
|
|
179
|
+
if (isPrototypePollutingKey(responseKey)) {
|
|
171
180
|
continue;
|
|
172
181
|
}
|
|
173
182
|
const existingPropValue = object[responseKey];
|
|
@@ -2696,6 +2705,7 @@ exports.getTypeInfoWithType = getTypeInfoWithType;
|
|
|
2696
2705
|
exports.getUnpathedErrors = getUnpathedErrors;
|
|
2697
2706
|
exports.handleResolverResult = handleResolverResult;
|
|
2698
2707
|
exports.isExternalObject = isExternalObject;
|
|
2708
|
+
exports.isPrototypePollutingKey = isPrototypePollutingKey;
|
|
2699
2709
|
exports.isSubschema = isSubschema;
|
|
2700
2710
|
exports.isSubschemaConfig = isSubschemaConfig;
|
|
2701
2711
|
exports.leftOverByDelegationPlan = leftOverByDelegationPlan;
|
package/dist/index.d.cts
CHANGED
|
@@ -219,10 +219,14 @@ interface DelegationPlanLeftOver {
|
|
|
219
219
|
missingFieldsParentDeferredMap: Map<ExternalObject, Map<string, Deferred>>;
|
|
220
220
|
}
|
|
221
221
|
declare const leftOverByDelegationPlan: WeakMap<Map<Subschema<any, any, any, Record<string, any>>, graphql.SelectionSetNode>[], DelegationPlanLeftOver>;
|
|
222
|
-
declare const PLAN_LEFT_OVER:
|
|
222
|
+
declare const PLAN_LEFT_OVER: symbol;
|
|
223
223
|
declare function getPlanLeftOverFromParent(parent: any): DelegationPlanLeftOver | undefined;
|
|
224
224
|
|
|
225
225
|
declare const getTypeInfo: (schema: GraphQLSchema) => TypeInfo;
|
|
226
226
|
declare const getTypeInfoWithType: (schema: GraphQLSchema, type: Maybe<GraphQLType>) => TypeInfo;
|
|
227
227
|
|
|
228
|
-
|
|
228
|
+
declare const prototypePollutingKeys: readonly ["__proto__", "constructor", "prototype"];
|
|
229
|
+
type PrototypePollutingKey = (typeof prototypePollutingKeys)[number];
|
|
230
|
+
declare function isPrototypePollutingKey(key: string): key is PrototypePollutingKey;
|
|
231
|
+
|
|
232
|
+
export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_ARRAY, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
|
package/dist/index.d.ts
CHANGED
|
@@ -219,10 +219,14 @@ interface DelegationPlanLeftOver {
|
|
|
219
219
|
missingFieldsParentDeferredMap: Map<ExternalObject, Map<string, Deferred>>;
|
|
220
220
|
}
|
|
221
221
|
declare const leftOverByDelegationPlan: WeakMap<Map<Subschema<any, any, any, Record<string, any>>, graphql.SelectionSetNode>[], DelegationPlanLeftOver>;
|
|
222
|
-
declare const PLAN_LEFT_OVER:
|
|
222
|
+
declare const PLAN_LEFT_OVER: symbol;
|
|
223
223
|
declare function getPlanLeftOverFromParent(parent: any): DelegationPlanLeftOver | undefined;
|
|
224
224
|
|
|
225
225
|
declare const getTypeInfo: (schema: GraphQLSchema) => TypeInfo;
|
|
226
226
|
declare const getTypeInfoWithType: (schema: GraphQLSchema, type: Maybe<GraphQLType>) => TypeInfo;
|
|
227
227
|
|
|
228
|
-
|
|
228
|
+
declare const prototypePollutingKeys: readonly ["__proto__", "constructor", "prototype"];
|
|
229
|
+
type PrototypePollutingKey = (typeof prototypePollutingKeys)[number];
|
|
230
|
+
declare function isPrototypePollutingKey(key: string): key is PrototypePollutingKey;
|
|
231
|
+
|
|
232
|
+
export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_ARRAY, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
|
package/dist/index.js
CHANGED
|
@@ -57,6 +57,15 @@ class Subschema {
|
|
|
57
57
|
}
|
|
58
58
|
}
|
|
59
59
|
|
|
60
|
+
const prototypePollutingKeys = [
|
|
61
|
+
"__proto__",
|
|
62
|
+
"constructor",
|
|
63
|
+
"prototype"
|
|
64
|
+
];
|
|
65
|
+
function isPrototypePollutingKey(key) {
|
|
66
|
+
return prototypePollutingKeys.includes(key);
|
|
67
|
+
}
|
|
68
|
+
|
|
60
69
|
const leftOverByDelegationPlan = /* @__PURE__ */ new WeakMap();
|
|
61
70
|
const PLAN_LEFT_OVER = Symbol("PLAN_LEFT_OVER");
|
|
62
71
|
function getPlanLeftOverFromParent(parent) {
|
|
@@ -167,7 +176,7 @@ function handleResolverResult(resolverResult, subschema, selectionSet, object, c
|
|
|
167
176
|
const objectSubschema = resolverResult[OBJECT_SUBSCHEMA_SYMBOL];
|
|
168
177
|
const fieldSubschemaMap = resolverResult[FIELD_SUBSCHEMA_MAP_SYMBOL];
|
|
169
178
|
for (const responseKey in resolverResult) {
|
|
170
|
-
if (responseKey
|
|
179
|
+
if (isPrototypePollutingKey(responseKey)) {
|
|
171
180
|
continue;
|
|
172
181
|
}
|
|
173
182
|
const existingPropValue = object[responseKey];
|
|
@@ -2662,4 +2671,4 @@ function subtractSelectionSets(selectionSetA, selectionSetB) {
|
|
|
2662
2671
|
});
|
|
2663
2672
|
}
|
|
2664
2673
|
|
|
2665
|
-
export { EMPTY_ARRAY, EMPTY_OBJECT, FIELD_SUBSCHEMA_MAP_SYMBOL, OBJECT_SUBSCHEMA_SYMBOL, PLAN_LEFT_OVER, Subschema, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleResolverResult, isExternalObject, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
|
|
2674
|
+
export { EMPTY_ARRAY, EMPTY_OBJECT, FIELD_SUBSCHEMA_MAP_SYMBOL, OBJECT_SUBSCHEMA_SYMBOL, PLAN_LEFT_OVER, Subschema, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
|
package/package.json
CHANGED