@graphql-tools/delegate 12.1.3 → 12.1.4-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @graphql-tools/delegate
 
+## 12.1.4-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db
+### Patch Changes
+
+
+
+- [#2600](https://github.com/graphql-hive/gateway/pull/2600) [`01a84ac`](https://github.com/graphql-hive/gateway/commit/01a84acdfea10b1b78bec729d5b530047f68ee4a) Thanks [@enisdenjo](https://github.com/enisdenjo)! - Drop prototype polluting keys from subgraph results before merging them
+  
+  Response keys named `__proto__`, `constructor` or `prototype`, which a client can produce with a field alias, were only filtered at the top level of a merged result. Nested occurrences were passed to `mergeDeep`, which walks the prototype chain and could end up writing to `Object.prototype` or `Function.prototype`.
+  
+  Such keys are now removed at every depth of a subgraph result before it takes part in a merge, and `projectDataSelectionSet` no longer treats an inherited property as an already projected field.
+
 ## 12.1.3
 ### Patch Changes
 

package/dist/index.cjs

@@ -75,6 +75,22 @@ const prototypePollutingKeys = [
 function isPrototypePollutingKey(key) {
   return prototypePollutingKeys.includes(key);
 }
+function removePrototypePollutingKeys(value) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      removePrototypePollutingKeys(item);
+    }
+  } else if (value && typeof value === "object" && !(value instanceof Error)) {
+    for (const key of Object.keys(value)) {
+      if (isPrototypePollutingKey(key)) {
+        delete value[key];
+      } else {
+        removePrototypePollutingKeys(value[key]);
+      }
+    }
+  }
+  return value;
+}
 
 const leftOverByDelegationPlan = /* @__PURE__ */ new WeakMap();
 const PLAN_LEFT_OVER = Symbol("PLAN_LEFT_OVER");
@@ -188,7 +204,9 @@ function handleResolverResult(resolverResult, subschema, selectionSet, object, c
       continue;
     }
     const existingPropValue = object[responseKey];
-    const sourcePropValue = resolverResult[responseKey];
+    const sourcePropValue = removePrototypePollutingKeys(
+      resolverResult[responseKey]
+    );
     if (responseKey === "__typename" && existingPropValue !== sourcePropValue && graphql.isAbstractType(subschema.transformedSchema.getType(sourcePropValue))) {
       continue;
     }
@@ -3564,5 +3582,6 @@ exports.isSubschema = isSubschema;
 exports.isSubschemaConfig = isSubschemaConfig;
 exports.leftOverByDelegationPlan = leftOverByDelegationPlan;
 exports.mergeFields = mergeFields;
+exports.removePrototypePollutingKeys = removePrototypePollutingKeys;
 exports.resolveExternalValue = resolveExternalValue;
 exports.subtractSelectionSets = subtractSelectionSets;

package/dist/index.d.cts

@@ -235,7 +235,16 @@ declare const getTypeInfoWithType: (schema: GraphQLSchema, type: Maybe<GraphQLTy
 declare const prototypePollutingKeys: readonly ["__proto__", "constructor", "prototype"];
 type PrototypePollutingKey = (typeof prototypePollutingKeys)[number];
 declare function isPrototypePollutingKey(key: string): key is PrototypePollutingKey;
+/**
+ * Removes prototype polluting keys from the given value, in place and at every depth.
+ *
+ * Response data coming from a subgraph can contain keys such as `__proto__` or
+ * `constructor` when the client aliases a field to one of those names. Deep merging
+ * such data walks the prototype chain and can end up writing to `Object.prototype` or
+ * `Function.prototype`, so the keys are dropped before any merge happens.
+ */
+declare function removePrototypePollutingKeys<T>(value: T): T;
 
 declare const handleOverrideByDelegation: (info: GraphQLResolveInfo$1, context: any, overrideHandler: OverrideHandler) => boolean;
 
-export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, type OverrideHandler, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
+export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, type OverrideHandler, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, removePrototypePollutingKeys, resolveExternalValue, subtractSelectionSets };

package/dist/index.d.ts

@@ -235,7 +235,16 @@ declare const getTypeInfoWithType: (schema: GraphQLSchema, type: Maybe<GraphQLTy
 declare const prototypePollutingKeys: readonly ["__proto__", "constructor", "prototype"];
 type PrototypePollutingKey = (typeof prototypePollutingKeys)[number];
 declare function isPrototypePollutingKey(key: string): key is PrototypePollutingKey;
+/**
+ * Removes prototype polluting keys from the given value, in place and at every depth.
+ *
+ * Response data coming from a subgraph can contain keys such as `__proto__` or
+ * `constructor` when the client aliases a field to one of those names. Deep merging
+ * such data walks the prototype chain and can end up writing to `Object.prototype` or
+ * `Function.prototype`, so the keys are dropped before any merge happens.
+ */
+declare function removePrototypePollutingKeys<T>(value: T): T;
 
 declare const handleOverrideByDelegation: (info: GraphQLResolveInfo$1, context: any, overrideHandler: OverrideHandler) => boolean;
 
-export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, type OverrideHandler, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
+export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, type OverrideHandler, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, removePrototypePollutingKeys, resolveExternalValue, subtractSelectionSets };

package/dist/index.js

@@ -75,6 +75,22 @@ const prototypePollutingKeys = [
 function isPrototypePollutingKey(key) {
   return prototypePollutingKeys.includes(key);
 }
+function removePrototypePollutingKeys(value) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      removePrototypePollutingKeys(item);
+    }
+  } else if (value && typeof value === "object" && !(value instanceof Error)) {
+    for (const key of Object.keys(value)) {
+      if (isPrototypePollutingKey(key)) {
+        delete value[key];
+      } else {
+        removePrototypePollutingKeys(value[key]);
+      }
+    }
+  }
+  return value;
+}
 
 const leftOverByDelegationPlan = /* @__PURE__ */ new WeakMap();
 const PLAN_LEFT_OVER = Symbol("PLAN_LEFT_OVER");
@@ -188,7 +204,9 @@ function handleResolverResult(resolverResult, subschema, selectionSet, object, c
       continue;
     }
     const existingPropValue = object[responseKey];
-    const sourcePropValue = resolverResult[responseKey];
+    const sourcePropValue = removePrototypePollutingKeys(
+      resolverResult[responseKey]
+    );
     if (responseKey === "__typename" && existingPropValue !== sourcePropValue && isAbstractType(subschema.transformedSchema.getType(sourcePropValue))) {
       continue;
     }
@@ -3525,4 +3543,4 @@ function subtractSelectionSets(selectionSetA, selectionSetB, fragments = {}) {
   };
 }
 
-export { EMPTY_OBJECT, FIELD_SUBSCHEMA_MAP_SYMBOL, OBJECT_SUBSCHEMA_SYMBOL, PLAN_LEFT_OVER, Subschema, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
+export { EMPTY_OBJECT, FIELD_SUBSCHEMA_MAP_SYMBOL, OBJECT_SUBSCHEMA_SYMBOL, PLAN_LEFT_OVER, Subschema, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, removePrototypePollutingKeys, resolveExternalValue, subtractSelectionSets };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphql-tools/delegate",
-  "version": "12.1.3",
+  "version": "12.1.4-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db",
   "type": "module",
   "description": "A set of utils for faster development of GraphQL tools",
   "repository": {