@graphql-tools/federation 4.4.14 → 4.4.15-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +15 -0
  2. package/dist/index.cjs +2 -2
  3. package/dist/index.js +3 -3
  4. package/package.json +4 -4
package/CHANGELOG.md CHANGED
@@ -1,5 +1,20 @@
1
1
  # @graphql-tools/federation
2
2
 
3
+ ## 4.4.15-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db
4
+ ### Patch Changes
5
+
6
+
7
+
8
+ - [#2600](https://github.com/graphql-hive/gateway/pull/2600) [`01a84ac`](https://github.com/graphql-hive/gateway/commit/01a84acdfea10b1b78bec729d5b530047f68ee4a) Thanks [@enisdenjo](https://github.com/enisdenjo)! - Drop prototype polluting keys from subgraph results before merging them
9
+
10
+ Response keys named `__proto__`, `constructor` or `prototype`, which a client can produce with a field alias, were only filtered at the top level of a merged result. Nested occurrences were passed to `mergeDeep`, which walks the prototype chain and could end up writing to `Object.prototype` or `Function.prototype`.
11
+
12
+ Such keys are now removed at every depth of a subgraph result before it takes part in a merge, and `projectDataSelectionSet` no longer treats an inherited property as an already projected field.
13
+ - Updated dependencies [[`01a84ac`](https://github.com/graphql-hive/gateway/commit/01a84acdfea10b1b78bec729d5b530047f68ee4a)]:
14
+ - @graphql-tools/delegate@12.1.4-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db
15
+ - @graphql-tools/stitch@10.2.5-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db
16
+ - @graphql-tools/wrap@11.1.24-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db
17
+
3
18
  ## 4.4.14
4
19
  ### Patch Changes
5
20
 
package/dist/index.cjs CHANGED
@@ -138,7 +138,7 @@ function projectDataSelectionSet(data, selectionSet) {
138
138
  data[responseKey],
139
139
  selection.selectionSet
140
140
  );
141
- if (projectedData[fieldName]) {
141
+ if (Object.prototype.hasOwnProperty.call(projectedData, fieldName) && projectedData[fieldName]) {
142
142
  if (projectedKeyData != null && !(projectedKeyData instanceof Error)) {
143
143
  projectedData[fieldName] = utils.mergeDeep(
144
144
  [projectedData[fieldName], projectedKeyData],
@@ -2320,7 +2320,7 @@ function mergeResults(results, getFieldNames) {
2320
2320
  } else if (result instanceof Error) {
2321
2321
  errors.push(result);
2322
2322
  } else if (result != null) {
2323
- datas.push(result);
2323
+ datas.push(delegate.removePrototypePollutingKeys(result));
2324
2324
  }
2325
2325
  }
2326
2326
  if (datas.length) {
package/dist/index.js CHANGED
@@ -1,4 +1,4 @@
1
- import { getTypeInfo, handleOverrideByDelegation, extractUnavailableFieldsFromSelectionSet, subtractSelectionSets, delegateToSchema, OBJECT_SUBSCHEMA_SYMBOL, FIELD_SUBSCHEMA_MAP_SYMBOL, UNPATHED_ERRORS_SYMBOL, isExternalObject, createDefaultExecutor } from '@graphql-tools/delegate';
1
+ import { getTypeInfo, handleOverrideByDelegation, extractUnavailableFieldsFromSelectionSet, subtractSelectionSets, delegateToSchema, removePrototypePollutingKeys, OBJECT_SUBSCHEMA_SYMBOL, FIELD_SUBSCHEMA_MAP_SYMBOL, UNPATHED_ERRORS_SYMBOL, isExternalObject, createDefaultExecutor } from '@graphql-tools/delegate';
2
2
  import { mapSchema, MapperKind, memoize1, parseSelectionSet, mergeDeep, getDirectiveExtensions, createGraphQLError, fakePromise } from '@graphql-tools/utils';
3
3
  import { DisposableSymbols } from '@whatwg-node/disposablestack';
4
4
  import { CustomEvent } from '@whatwg-node/events';
@@ -136,7 +136,7 @@ function projectDataSelectionSet(data, selectionSet) {
136
136
  data[responseKey],
137
137
  selection.selectionSet
138
138
  );
139
- if (projectedData[fieldName]) {
139
+ if (Object.prototype.hasOwnProperty.call(projectedData, fieldName) && projectedData[fieldName]) {
140
140
  if (projectedKeyData != null && !(projectedKeyData instanceof Error)) {
141
141
  projectedData[fieldName] = mergeDeep(
142
142
  [projectedData[fieldName], projectedKeyData],
@@ -2318,7 +2318,7 @@ function mergeResults(results, getFieldNames) {
2318
2318
  } else if (result instanceof Error) {
2319
2319
  errors.push(result);
2320
2320
  } else if (result != null) {
2321
- datas.push(result);
2321
+ datas.push(removePrototypePollutingKeys(result));
2322
2322
  }
2323
2323
  }
2324
2324
  if (datas.length) {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@graphql-tools/federation",
3
- "version": "4.4.14",
3
+ "version": "4.4.15-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db",
4
4
  "type": "module",
5
5
  "description": "Useful tools to create and manipulate GraphQL schemas.",
6
6
  "repository": {
@@ -38,14 +38,14 @@
38
38
  "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0"
39
39
  },
40
40
  "dependencies": {
41
- "@graphql-tools/delegate": "^12.1.3",
41
+ "@graphql-tools/delegate": "12.1.4-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db",
42
42
  "@graphql-tools/executor": "^1.4.13",
43
43
  "@graphql-tools/executor-http": "^3.3.0",
44
44
  "@graphql-tools/merge": "^9.1.5",
45
45
  "@graphql-tools/schema": "^10.0.29",
46
- "@graphql-tools/stitch": "^10.2.4",
46
+ "@graphql-tools/stitch": "10.2.5-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db",
47
47
  "@graphql-tools/utils": "^11.0.0",
48
- "@graphql-tools/wrap": "^11.1.23",
48
+ "@graphql-tools/wrap": "11.1.24-alpha-bcfb2c1cde3a349458d33360e3f4a5f19eb134db",
49
49
  "@graphql-yoga/typed-event-target": "^3.0.2",
50
50
  "@whatwg-node/disposablestack": "^0.0.6",
51
51
  "@whatwg-node/events": "^0.1.2",