@graphql-tools/utils 12.0.1 → 12.0.3

package/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createDeferred = exports.fakePromise = exports.mapMaybePromise = exports.mapAsyncIterator = exports.inspect = void 0;
+exports.createDeferred = exports.fakePromise = exports.mapAsyncIterator = exports.mapMaybePromise = exports.inspect = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./loaders.js"), exports);
 tslib_1.__exportStar(require("./helpers.js"), exports);
@@ -60,9 +60,10 @@ tslib_1.__exportStar(require("./directives.js"), exports);
 tslib_1.__exportStar(require("./mergeIncrementalResult.js"), exports);
 tslib_1.__exportStar(require("./debugTimer.js"), exports);
 tslib_1.__exportStar(require("./getDirectiveExtensions.js"), exports);
+var jsutils_js_1 = require("./jsutils.js");
+Object.defineProperty(exports, "mapMaybePromise", { enumerable: true, get: function () { return jsutils_js_1.mapMaybePromise; } });
 var promise_helpers_1 = require("@whatwg-node/promise-helpers");
 Object.defineProperty(exports, "mapAsyncIterator", { enumerable: true, get: function () { return promise_helpers_1.mapAsyncIterator; } });
-Object.defineProperty(exports, "mapMaybePromise", { enumerable: true, get: function () { return promise_helpers_1.mapMaybePromise; } });
 Object.defineProperty(exports, "fakePromise", { enumerable: true, get: function () { return promise_helpers_1.fakePromise; } });
 Object.defineProperty(exports, "createDeferred", { enumerable: true, get: function () { return promise_helpers_1.createDeferredPromise; } });
 tslib_1.__exportStar(require("./registerAbortSignalListener.js"), exports);

package/cjs/jsutils.js

@@ -3,8 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isPromise = void 0;
 exports.isIterableObject = isIterableObject;
 exports.isObjectLike = isObjectLike;
+exports.mapMaybePromise = mapMaybePromise;
 exports.promiseReduce = promiseReduce;
 exports.hasOwnProperty = hasOwnProperty;
+exports.isDangerousObjectKey = isDangerousObjectKey;
+exports.isSafeObjectKey = isSafeObjectKey;
 const promise_helpers_1 = require("@whatwg-node/promise-helpers");
 Object.defineProperty(exports, "isPromise", { enumerable: true, get: function () { return promise_helpers_1.isPromise; } });
 function isIterableObject(value) {
@@ -13,6 +16,9 @@ function isIterableObject(value) {
 function isObjectLike(value) {
     return typeof value === 'object' && value !== null;
 }
+function mapMaybePromise(input, onSuccess, onError) {
+    return (0, promise_helpers_1.handleMaybePromise)(() => input, onSuccess, onError);
+}
 function promiseReduce(values, callbackFn, initialValue) {
     let accumulator = initialValue;
     for (const value of values) {
@@ -23,3 +29,21 @@ function promiseReduce(values, callbackFn, initialValue) {
 function hasOwnProperty(obj, prop) {
     return Object.prototype.hasOwnProperty.call(obj, prop);
 }
+/**
+ * True for keys that must never be used for object-path writes because they
+ * reach the prototype chain (`__proto__`, `constructor`, `prototype`).
+ */
+function isDangerousObjectKey(key) {
+    return key === '__proto__' || key === 'constructor' || key === 'prototype';
+}
+/**
+ * True when `key` is a primitive string/number that is safe to use for
+ * own-property access. Rejects non-primitives (which coerce via `ToPropertyKey`)
+ * and {@link isDangerousObjectKey dangerous names}.
+ */
+function isSafeObjectKey(key) {
+    if (typeof key !== 'string' && typeof key !== 'number') {
+        return false;
+    }
+    return !isDangerousObjectKey(key);
+}

package/cjs/mergeDeep.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mergeDeep = mergeDeep;
 const helpers_js_1 = require("./helpers.js");
+const jsutils_js_1 = require("./jsutils.js");
 function mergeDeep(sources, respectPrototype = false, respectArrays = false, respectArrayLength = false, respectNonEnumerableSymbols = false) {
     if (sources.length === 0) {
         return;
@@ -65,7 +66,7 @@ function mergeDeep(sources, respectPrototype = false, respectArrays = false, res
             }
             for (const key in source) {
                 // never let a source key reach the prototype chain
-                if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+                if ((0, jsutils_js_1.isDangerousObjectKey)(key)) {
                     continue;
                 }
                 // An own key present with value `undefined` is an explicit override and must win,

package/cjs/mergeIncrementalResult.js

@@ -1,14 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mergeIncrementalResult = mergeIncrementalResult;
+const jsutils_js_1 = require("./jsutils.js");
 const mergeDeep_js_1 = require("./mergeDeep.js");
 function mergeIncrementalResult({ incrementalResult, executionResult, }) {
     const path = ['data', ...(incrementalResult.path ?? [])];
     if (incrementalResult.items) {
-        for (const item of incrementalResult.items) {
-            setObjectKeyPath(executionResult, path, item);
-            // Increment the last path segment (the array index) to merge the next item at the next index
-            path[path.length - 1]++;
+        // Reject the whole items batch if any path segment is unsafe, so a later
+        // index increment cannot turn a bad segment into a write at `data.NaN`.
+        if (isSafeKeyPath(path)) {
+            for (const item of incrementalResult.items) {
+                setObjectKeyPath(executionResult, path, item);
+                // Increment the last path segment (the array index) to merge the next item at the next index
+                path[path.length - 1]++;
+            }
         }
     }
     if (incrementalResult.data) {
@@ -30,24 +35,34 @@ function mergeIncrementalResult({ incrementalResult, executionResult, }) {
         });
     }
 }
+function isSafeKeyPath(keyPath) {
+    return keyPath.every(jsutils_js_1.isSafeObjectKey);
+}
 function setObjectKeyPath(obj, keyPath, value) {
+    // Validate the full path before creating any parent containers, so a late
+    // unsafe segment cannot leave partial writes on executionResult.
+    if (!isSafeKeyPath(keyPath)) {
+        return;
+    }
     let current = obj;
     let i;
     for (i = 0; i < keyPath.length - 1; i++) {
         const key = keyPath[i];
-        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+        // Direct comparison, not only isSafeObjectKey(): that helper already rejects
+        // this key, but the check has to sit on the value used as the property name.
+        if (key === '__proto__' || !(0, jsutils_js_1.isSafeObjectKey)(key)) {
             return;
         }
-        if (current[key] == null) {
+        if (!(0, jsutils_js_1.hasOwnProperty)(current, key) || current[key] == null) {
             // Determine if the next key is a number to create an array, otherwise create an object
             current[key] = typeof keyPath[i + 1] === 'number' ? [] : {};
         }
         current = current[key];
     }
     const finalKey = keyPath[i];
-    if (finalKey === '__proto__' || finalKey === 'constructor' || finalKey === 'prototype') {
+    if (finalKey === '__proto__' || !(0, jsutils_js_1.isSafeObjectKey)(finalKey)) {
         return;
     }
-    const existingValue = current[finalKey];
+    const existingValue = (0, jsutils_js_1.hasOwnProperty)(current, finalKey) ? current[finalKey] : undefined;
     current[finalKey] = existingValue != null ? (0, mergeDeep_js_1.mergeDeep)([existingValue, value]) : value;
 }

package/esm/index.js

@@ -55,6 +55,7 @@ export * from './directives.js';
 export * from './mergeIncrementalResult.js';
 export * from './debugTimer.js';
 export * from './getDirectiveExtensions.js';
-export { mapAsyncIterator, mapMaybePromise, fakePromise, createDeferredPromise as createDeferred, } from '@whatwg-node/promise-helpers';
+export { mapMaybePromise } from './jsutils.js';
+export { mapAsyncIterator, fakePromise, createDeferredPromise as createDeferred, } from '@whatwg-node/promise-helpers';
 export * from './registerAbortSignalListener.js';
 export * from './getDirectiveValues.js';

package/esm/jsutils.js

@@ -6,6 +6,9 @@ export function isObjectLike(value) {
     return typeof value === 'object' && value !== null;
 }
 export { isPromise };
+export function mapMaybePromise(input, onSuccess, onError) {
+    return handleMaybePromise(() => input, onSuccess, onError);
+}
 export function promiseReduce(values, callbackFn, initialValue) {
     let accumulator = initialValue;
     for (const value of values) {
@@ -16,3 +19,21 @@ export function promiseReduce(values, callbackFn, initialValue) {
 export function hasOwnProperty(obj, prop) {
     return Object.prototype.hasOwnProperty.call(obj, prop);
 }
+/**
+ * True for keys that must never be used for object-path writes because they
+ * reach the prototype chain (`__proto__`, `constructor`, `prototype`).
+ */
+export function isDangerousObjectKey(key) {
+    return key === '__proto__' || key === 'constructor' || key === 'prototype';
+}
+/**
+ * True when `key` is a primitive string/number that is safe to use for
+ * own-property access. Rejects non-primitives (which coerce via `ToPropertyKey`)
+ * and {@link isDangerousObjectKey dangerous names}.
+ */
+export function isSafeObjectKey(key) {
+    if (typeof key !== 'string' && typeof key !== 'number') {
+        return false;
+    }
+    return !isDangerousObjectKey(key);
+}

package/esm/mergeDeep.js

@@ -1,4 +1,5 @@
 import { isSome } from './helpers.js';
+import { isDangerousObjectKey } from './jsutils.js';
 export function mergeDeep(sources, respectPrototype = false, respectArrays = false, respectArrayLength = false, respectNonEnumerableSymbols = false) {
     if (sources.length === 0) {
         return;
@@ -62,7 +63,7 @@ export function mergeDeep(sources, respectPrototype = false, respectArrays = fal
             }
             for (const key in source) {
                 // never let a source key reach the prototype chain
-                if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+                if (isDangerousObjectKey(key)) {
                     continue;
                 }
                 // An own key present with value `undefined` is an explicit override and must win,

package/esm/mergeIncrementalResult.js

@@ -1,11 +1,16 @@
+import { hasOwnProperty, isSafeObjectKey } from './jsutils.js';
 import { mergeDeep } from './mergeDeep.js';
 export function mergeIncrementalResult({ incrementalResult, executionResult, }) {
     const path = ['data', ...(incrementalResult.path ?? [])];
     if (incrementalResult.items) {
-        for (const item of incrementalResult.items) {
-            setObjectKeyPath(executionResult, path, item);
-            // Increment the last path segment (the array index) to merge the next item at the next index
-            path[path.length - 1]++;
+        // Reject the whole items batch if any path segment is unsafe, so a later
+        // index increment cannot turn a bad segment into a write at `data.NaN`.
+        if (isSafeKeyPath(path)) {
+            for (const item of incrementalResult.items) {
+                setObjectKeyPath(executionResult, path, item);
+                // Increment the last path segment (the array index) to merge the next item at the next index
+                path[path.length - 1]++;
+            }
         }
     }
     if (incrementalResult.data) {
@@ -27,24 +32,34 @@ export function mergeIncrementalResult({ incrementalResult, executionResult, })
         });
     }
 }
+function isSafeKeyPath(keyPath) {
+    return keyPath.every(isSafeObjectKey);
+}
 function setObjectKeyPath(obj, keyPath, value) {
+    // Validate the full path before creating any parent containers, so a late
+    // unsafe segment cannot leave partial writes on executionResult.
+    if (!isSafeKeyPath(keyPath)) {
+        return;
+    }
     let current = obj;
     let i;
     for (i = 0; i < keyPath.length - 1; i++) {
         const key = keyPath[i];
-        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+        // Direct comparison, not only isSafeObjectKey(): that helper already rejects
+        // this key, but the check has to sit on the value used as the property name.
+        if (key === '__proto__' || !isSafeObjectKey(key)) {
             return;
         }
-        if (current[key] == null) {
+        if (!hasOwnProperty(current, key) || current[key] == null) {
             // Determine if the next key is a number to create an array, otherwise create an object
             current[key] = typeof keyPath[i + 1] === 'number' ? [] : {};
         }
         current = current[key];
     }
     const finalKey = keyPath[i];
-    if (finalKey === '__proto__' || finalKey === 'constructor' || finalKey === 'prototype') {
+    if (finalKey === '__proto__' || !isSafeObjectKey(finalKey)) {
         return;
     }
-    const existingValue = current[finalKey];
+    const existingValue = hasOwnProperty(current, finalKey) ? current[finalKey] : undefined;
     current[finalKey] = existingValue != null ? mergeDeep([existingValue, value]) : value;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphql-tools/utils",
-  "version": "12.0.1",
+  "version": "12.0.3",
   "description": "Common package containing utils and types for GraphQL tools",
   "sideEffects": false,
   "peerDependencies": {
@@ -8,7 +8,7 @@
   },
   "dependencies": {
     "@graphql-typed-document-node/core": "^3.1.1",
-    "@whatwg-node/promise-helpers": "^1.0.0",
+    "@whatwg-node/promise-helpers": "^2.0.0",
     "cross-inspect": "1.0.1",
     "tslib": "^2.4.0"
   },

package/typings/index.d.cts

@@ -55,6 +55,7 @@ export * from './directives.cjs';
 export * from './mergeIncrementalResult.cjs';
 export * from './debugTimer.cjs';
 export * from './getDirectiveExtensions.cjs';
-export { mapAsyncIterator, mapMaybePromise, fakePromise, createDeferredPromise as createDeferred, } from '@whatwg-node/promise-helpers';
+export { mapMaybePromise } from './jsutils.cjs';
+export { mapAsyncIterator, fakePromise, createDeferredPromise as createDeferred, } from '@whatwg-node/promise-helpers';
 export * from './registerAbortSignalListener.cjs';
 export * from './getDirectiveValues.cjs';

package/typings/index.d.ts

@@ -55,6 +55,7 @@ export * from './directives.js';
 export * from './mergeIncrementalResult.js';
 export * from './debugTimer.js';
 export * from './getDirectiveExtensions.js';
-export { mapAsyncIterator, mapMaybePromise, fakePromise, createDeferredPromise as createDeferred, } from '@whatwg-node/promise-helpers';
+export { mapMaybePromise } from './jsutils.js';
+export { mapAsyncIterator, fakePromise, createDeferredPromise as createDeferred, } from '@whatwg-node/promise-helpers';
 export * from './registerAbortSignalListener.js';
 export * from './getDirectiveValues.js';

package/typings/jsutils.d.cts

@@ -4,5 +4,17 @@ export declare function isObjectLike(value: unknown): value is {
     [key: string]: unknown;
 };
 export { isPromise };
+export declare function mapMaybePromise<TInput, TOutput>(input: MaybePromise<TInput>, onSuccess: (value: TInput) => MaybePromise<TOutput>, onError?: (err: any) => MaybePromise<TOutput>): MaybePromise<TOutput>;
 export declare function promiseReduce<T, U>(values: Iterable<T>, callbackFn: (accumulator: U, currentValue: T) => MaybePromise<U>, initialValue: MaybePromise<U>): MaybePromise<U>;
-export declare function hasOwnProperty(obj: unknown, prop: string): boolean;
+export declare function hasOwnProperty(obj: unknown, prop: PropertyKey): boolean;
+/**
+ * True for keys that must never be used for object-path writes because they
+ * reach the prototype chain (`__proto__`, `constructor`, `prototype`).
+ */
+export declare function isDangerousObjectKey(key: unknown): boolean;
+/**
+ * True when `key` is a primitive string/number that is safe to use for
+ * own-property access. Rejects non-primitives (which coerce via `ToPropertyKey`)
+ * and {@link isDangerousObjectKey dangerous names}.
+ */
+export declare function isSafeObjectKey(key: unknown): key is string | number;

package/typings/jsutils.d.ts

@@ -4,5 +4,17 @@ export declare function isObjectLike(value: unknown): value is {
     [key: string]: unknown;
 };
 export { isPromise };
+export declare function mapMaybePromise<TInput, TOutput>(input: MaybePromise<TInput>, onSuccess: (value: TInput) => MaybePromise<TOutput>, onError?: (err: any) => MaybePromise<TOutput>): MaybePromise<TOutput>;
 export declare function promiseReduce<T, U>(values: Iterable<T>, callbackFn: (accumulator: U, currentValue: T) => MaybePromise<U>, initialValue: MaybePromise<U>): MaybePromise<U>;
-export declare function hasOwnProperty(obj: unknown, prop: string): boolean;
+export declare function hasOwnProperty(obj: unknown, prop: PropertyKey): boolean;
+/**
+ * True for keys that must never be used for object-path writes because they
+ * reach the prototype chain (`__proto__`, `constructor`, `prototype`).
+ */
+export declare function isDangerousObjectKey(key: unknown): boolean;
+/**
+ * True when `key` is a primitive string/number that is safe to use for
+ * own-property access. Rejects non-primitives (which coerce via `ToPropertyKey`)
+ * and {@link isDangerousObjectKey dangerous names}.
+ */
+export declare function isSafeObjectKey(key: unknown): key is string | number;