@graphql-tools/wrap 10.0.28 → 10.0.29-alpha-117d5221fdd40912b571f033539fcea93e434d3d

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @graphql-tools/wrap
 
+## 10.0.29-alpha-117d5221fdd40912b571f033539fcea93e434d3d
+
+### Patch Changes
+
+- Updated dependencies [[`a2842ab`](https://github.com/graphql-hive/gateway/commit/a2842ab8177d08b0c6cc72fa94b4a2f05857cd57)]:
+  - @graphql-tools/delegate@10.2.11-alpha-117d5221fdd40912b571f033539fcea93e434d3d
+
 ## 10.0.28
 
 ### Patch Changes

package/dist/index.cjs

@@ -1428,7 +1428,7 @@ class TransformQuery {
     errorPathTransformer = (errorPath) => [...errorPath],
     fragments = {}
   }) {
-    this.path = path;
+    this.path = path.filter((key) => !delegate.isPrototypePollutingKey(key));
     this.queryTransformer = queryTransformer;
     this.resultTransformer = resultTransformer;
     this.errorPathTransformer = errorPathTransformer;
@@ -2306,11 +2306,18 @@ class WrapQuery {
       const path = [...this.path];
       while (path.length > 1) {
         const next = path.shift();
+        if (delegate.isPrototypePollutingKey(next)) {
+          throw new Error("Invalid path key");
+        }
         if (data[next]) {
           data = data[next];
         }
       }
-      data[path[0]] = this.extractor(data[path[0]]);
+      const lastKey = path[0];
+      if (delegate.isPrototypePollutingKey(lastKey)) {
+        throw new Error("Invalid path key");
+      }
+      data[lastKey] = this.extractor(data[lastKey]);
     }
     return {
       data: rootData,

package/dist/index.js

@@ -1,4 +1,4 @@
-import { delegateToSchema, isExternalObject, getUnpathedErrors, getSubschema, resolveExternalValue, applySchemaTransforms, defaultMergedResolver, getTypeInfo as getTypeInfo$1 } from '@graphql-tools/delegate';
+import { delegateToSchema, isExternalObject, getUnpathedErrors, getSubschema, resolveExternalValue, applySchemaTransforms, defaultMergedResolver, getTypeInfo as getTypeInfo$1, isPrototypePollutingKey } from '@graphql-tools/delegate';
 import { getRootTypeMap, getResponseKeyFromInfo, memoize1, mapSchema, MapperKind, renameType, visitData, transformInputValue, getDefinedRootType, memoize2, visitResult, astFromValueUntyped, getOperationASTFromRequest, relocatedError, getArgumentValues, valueMatchesCriteria, getDirectives, pruneSchema, selectObjectFields, appendObjectFields, modifyObjectFields, removeObjectFields, mapMaybePromise, isAsyncIterable, createGraphQLError, inspect } from '@graphql-tools/utils';
 import { GraphQLObjectType, GraphQLInterfaceType, GraphQLUnionType, isSpecifiedScalarType, isScalarType, visit, Kind, visitWithTypeInfo, isObjectType, isInterfaceType, typeFromAST, isInputType, getNamedType, TypeInfo, versionInfo, isLeafType, valueFromAST, valueFromASTUntyped, astFromValue, GraphQLNonNull, getNullableType, isListType, GraphQLList, BREAK, parse, getIntrospectionQuery, buildClientSchema } from 'graphql';
 
@@ -1426,7 +1426,7 @@ class TransformQuery {
     errorPathTransformer = (errorPath) => [...errorPath],
     fragments = {}
   }) {
-    this.path = path;
+    this.path = path.filter((key) => !isPrototypePollutingKey(key));
     this.queryTransformer = queryTransformer;
     this.resultTransformer = resultTransformer;
     this.errorPathTransformer = errorPathTransformer;
@@ -2304,11 +2304,18 @@ class WrapQuery {
       const path = [...this.path];
       while (path.length > 1) {
         const next = path.shift();
+        if (isPrototypePollutingKey(next)) {
+          throw new Error("Invalid path key");
+        }
         if (data[next]) {
           data = data[next];
         }
       }
-      data[path[0]] = this.extractor(data[path[0]]);
+      const lastKey = path[0];
+      if (isPrototypePollutingKey(lastKey)) {
+        throw new Error("Invalid path key");
+      }
+      data[lastKey] = this.extractor(data[lastKey]);
     }
     return {
       data: rootData,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphql-tools/wrap",
-  "version": "10.0.28",
+  "version": "10.0.29-alpha-117d5221fdd40912b571f033539fcea93e434d3d",
   "type": "module",
   "description": "A set of utils for faster development of GraphQL tools",
   "repository": {
@@ -38,7 +38,7 @@
     "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0"
   },
   "dependencies": {
-    "@graphql-tools/delegate": "^10.2.10",
+    "@graphql-tools/delegate": "10.2.11-alpha-117d5221fdd40912b571f033539fcea93e434d3d",
     "@graphql-tools/schema": "^10.0.11",
     "@graphql-tools/utils": "^10.7.0",
     "tslib": "^2.8.1"