@salesforce/lds-adapters-uiapi 1.454.0 → 1.456.0

package/dist/es/es2018/types/src/util/language.d.ts

@@ -12,7 +12,7 @@ declare const assign: {
         [idx: string]: object | U | null | undefined;
     }, U extends string | number | bigint | boolean | symbol>(o: T_1): Readonly<T_1>;
     <T_2>(o: T_2): Readonly<T_2>;
-}, isFrozen: (o: any) => boolean, keys: {
+}, getPrototypeOf: (o: any) => any, isFrozen: (o: any) => boolean, keys: {
     (o: object): string[];
     (o: {}): string[];
 };
@@ -39,4 +39,4 @@ declare const parse: (text: string, reviver?: ((this: any, key: string, value: a
     (value: any, replacer?: ((this: any, key: string, value: any) => any) | undefined, space?: string | number | undefined): string;
     (value: any, replacer?: (string | number)[] | null | undefined, space?: string | number | undefined): string;
 };
-export { assign as ObjectAssign, create as ObjectCreate, freeze as ObjectFreeze, isFrozen as ObjectIsFrozen, keys as ObjectKeys, hasOwnProperty as ObjectPrototypeHasOwnProperty, isArray as ArrayIsArray, concat as ArrayPrototypeConcat, filter as ArrayPrototypeFilter, includes as ArrayPrototypeIncludes, push as ArrayPrototypePush, reduce as ArrayPrototypeReduce, split as StringPrototypeSplit, endsWith as StringPrototypeEndsWith, parse as JSONParse, stringify as JSONStringify, };
+export { assign as ObjectAssign, create as ObjectCreate, freeze as ObjectFreeze, getPrototypeOf as ObjectGetPrototypeOf, isFrozen as ObjectIsFrozen, keys as ObjectKeys, hasOwnProperty as ObjectPrototypeHasOwnProperty, isArray as ArrayIsArray, concat as ArrayPrototypeConcat, filter as ArrayPrototypeFilter, includes as ArrayPrototypeIncludes, push as ArrayPrototypePush, reduce as ArrayPrototypeReduce, split as StringPrototypeSplit, endsWith as StringPrototypeEndsWith, parse as JSONParse, stringify as JSONStringify, };

package/dist/es/es2018/uiapi-records-service.js

@@ -435,7 +435,7 @@ function buildAdapterValidationConfig(displayName, paramsMeta) {
 }
 const keyPrefix = 'UiApi';
 
-const { assign, create, freeze, isFrozen, keys } = Object;
+const { assign, create, freeze, getPrototypeOf, isFrozen, keys } = Object;
 const { hasOwnProperty } = Object.prototype;
 const { split, endsWith } = String.prototype;
 const { isArray } = Array;
@@ -3711,6 +3711,24 @@ function isFieldValueRepresentation(unknown) {
     }
     return 'value' in unknown && 'displayValue' in unknown;
 }
+/**
+ * Whether `value` is a plain data object safe to index into as a record's
+ * `fields` map. getField runs as trusted (system-mode) code walking a caller-
+ * supplied dot-path, so indexing into a host/exotic object (e.g. `window`) or
+ * reading a prototype-chain property (e.g. `__proto__`) would let it read host
+ * state on the caller's behalf -- the same class of confused-deputy sandbox
+ * escape fixed for `getSObjectValue` (W-23862210). Record field maps are
+ * JSON-derived plain objects, so we accept only a prototype chain that ends
+ * immediately at an `Object.prototype` (or `null`), which also keeps
+ * cross-realm/membrane records (LWS) valid.
+ */
+function isTraversableFieldsMap(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const proto = getPrototypeOf(value);
+    return proto === null || getPrototypeOf(proto) === null;
+}
 function getField(record, field) {
     const fieldApiName = getFieldApiName(field);
     if (fieldApiName === undefined) {
@@ -3720,7 +3738,13 @@ function getField(record, field) {
     const fields = unqualifiedField.split('.');
     let r = record;
     while (r && r.fields) {
+        if (isTraversableFieldsMap(r.fields) === false) {
+            return undefined;
+        }
         const f = fields.shift();
+        if (!hasOwnProperty.call(r.fields, f)) {
+            return undefined;
+        }
         const fvr = r.fields[f];
         if (fvr === undefined) {
             return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-adapters-uiapi",
-    "version": "1.454.0",
+    "version": "1.456.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "Wire adapters for record related UI API endpoints",
     "type": "module",
@@ -63,14 +63,14 @@
     },
     "dependencies": {
         "@luvio/graphql-parser": "0.161.2",
-        "@salesforce/lds-bindings": "^1.454.0",
-        "@salesforce/lds-default-luvio": "^1.454.0"
+        "@salesforce/lds-bindings": "^1.456.0",
+        "@salesforce/lds-default-luvio": "^1.456.0"
     },
     "devDependencies": {
-        "@salesforce/lds-adapters-onestore-graphql": "^1.454.0",
-        "@salesforce/lds-compiler-plugins": "^1.454.0",
-        "@salesforce/lds-jest": "^1.454.0",
-        "@salesforce/lds-store-binary": "^1.454.0"
+        "@salesforce/lds-adapters-onestore-graphql": "^1.456.0",
+        "@salesforce/lds-compiler-plugins": "^1.456.0",
+        "@salesforce/lds-jest": "^1.456.0",
+        "@salesforce/lds-store-binary": "^1.456.0"
     },
     "luvioBundlesize": [
         {

package/sfdc/graphqlAdapters.js

@@ -16264,7 +16264,7 @@ function keyBuilderFromType(luvio, object) {
     return keyBuilder$z(luvio, keyParams);
 }
 
-const { assign, create, freeze, isFrozen, keys } = Object;
+const { assign, create, freeze, getPrototypeOf, isFrozen, keys } = Object;
 const { isArray } = Array;
 const { concat, filter, includes, push, reduce } = Array.prototype;
 
@@ -28845,4 +28845,4 @@ register({
 });
 
 export { configurationForGraphQLAdapters as configuration, graphql, factory$1 as graphqlAdapterFactory, graphqlBatch, graphqlBatch_imperative, graphql_deprecated, graphql_imperative, graphql_imperative_deprecated, graphql_imperative_onestore, graphql_onestore, graphql_state_manager, refreshGraphQL, refreshGraphQL_deprecated };
-// version: 1.454.0-761808c4e9
+// version: 1.456.0-6ed480b93c

package/sfdc/index.js

@@ -492,7 +492,7 @@ function buildAdapterValidationConfig(displayName, paramsMeta) {
 }
 const keyPrefix = 'UiApi';
 
-const { assign, create, freeze, isFrozen, keys } = Object;
+const { assign, create, freeze, getPrototypeOf, isFrozen, keys } = Object;
 const { hasOwnProperty } = Object.prototype;
 const { split, endsWith } = String.prototype;
 const { isArray } = Array;
@@ -37522,4 +37522,4 @@ withDefaultLuvio((luvio) => {
 });
 
 export { API_NAMESPACE, VERSION$1i as FieldValueRepresentationVersion, InMemoryRecordRepresentationQueryEvaluator, MRU, RepresentationType$J as ObjectInfoDirectoryEntryRepresentationType, RepresentationType$O as ObjectInfoRepresentationType, RECORD_FIELDS_KEY_JUNCTION, RECORD_ID_PREFIX, RECORD_REPRESENTATION_NAME, RECORD_VIEW_ENTITY_ID_PREFIX, RECORD_VIEW_ENTITY_REPRESENTATION_NAME, RepresentationType$V as RecordRepresentationRepresentationType, TTL$z as RecordRepresentationTTL, RepresentationType$V as RecordRepresentationType, VERSION$1g as RecordRepresentationVersion, keyPrefix as UiApiNamespace, buildRecordRepKeyFromId, getFieldApiNamesArray as coerceFieldIdArray, coerceLayoutModeArray, getLayoutTypeArray as coerceLayoutTypeArray, getObjectApiName$1 as coerceObjectId, getObjectApiNamesArray as coerceObjectIdArray, configurationForRestAdapters as configuration, createContentDocumentAndVersion, createContentVersion, createIngestRecordWithFields, createLDSAdapterWithPrediction, createListInfo, createRecord, deleteListInfo, deleteRecord, executeBatchRecordOperations, extractRecordIdFromStoreKey, getActionOverrides, getActionOverrides_imperative, getAllApps, getAllApps_imperative, getAppDetails, getAppDetails_imperative, getDuplicateConfiguration, getDuplicateConfiguration_imperative, getDuplicates, getDuplicates_imperative, getFlexipageFormulaOverrides, getFlexipageFormulaOverrides_imperative, getGlobalActions, getGlobalActions_imperative, getKeywordSearchResults, getKeywordSearchResults_imperative, getLayout, getLayoutUserState, getLayoutUserState_imperative, getLayout_imperative, getListInfoByName, getListInfoByNameAdapterFactory, getListInfoByName_imperative, getListInfosByName, getListInfosByName_imperative, getListInfosByObjectName, getListInfosByObjectNameAdapterFactory, getListInfosByObjectName_imperative, getListObjectInfo, getListObjectInfoAdapterFactory, getListObjectInfo_imperative, getListPreferences, getListPreferences_imperative, getListRecordsByName, factory$a as getListRecordsByNameAdapterFactory, getListRecordsByName_imperative, getListUi, getListUi_imperative, getLookupActions, getLookupActions_imperative, getLookupMetadata, getLookupMetadata_imperative, getLookupRecords, getLookupRecords_imperative, getNavItems, getNavItems_imperative, getObjectCreateActions, getObjectCreateActions_imperative, getObjectInfo, getObjectInfoAdapterFactory, getObjectInfoDirectoryAdapterFactory, getObjectInfo_imperative, getObjectInfos, getObjectInfosAdapterFactory, getObjectInfos_imperative, getPathLayout, getPathLayout_imperative, getPicklistValues, getPicklistValuesByRecordType, getPicklistValuesByRecordType_imperative, getPicklistValues_imperative, getQuickActionDefaults, getQuickActionDefaults_imperative, getQuickActionInfo, getQuickActionInfo_imperative, getQuickActionLayout, getQuickActionLayout_imperative, getRecord, getRecordActions, getRecordActionsAdapterFactory, getRecordActions_imperative, factory$f as getRecordAdapterFactory, getRecordAvatars, getRecordAvatarsAdapterFactory, getRecordAvatars_imperative, getRecordCreateDefaults, getRecordCreateDefaults_imperative, getRecordEditActions, getRecordEditActions_imperative, getRecordId18, getRecordId18Array, getRecordIngestionOverride, getRecordNotifyChange, getRecordTemplateClone, getRecordTemplateClone_imperative, getRecordTemplateCreate, getRecordTemplateCreate_imperative, getRecordUi, getRecordUi_imperative, getRecord_imperative, getRecords, getRecordsAdapterFactory, getRecords_imperative, getRelatedListActions, getRelatedListActionsAdapterFactory, getRelatedListActions_imperative, getRelatedListCount, getRelatedListCount_imperative, getRelatedListInfo, getRelatedListInfoAdapterFactory, getRelatedListInfoBatch, getRelatedListInfoBatchAdapterFactory, getRelatedListInfoBatch_imperative, getRelatedListInfo_imperative, getRelatedListPreferences, getRelatedListPreferencesBatch, getRelatedListPreferencesBatch_imperative, getRelatedListPreferences_imperative, getRelatedListRecordActions, getRelatedListRecordActions_imperative, getRelatedListRecords, getRelatedListRecordsAdapterFactory, getRelatedListRecordsBatch, getRelatedListRecordsBatchAdapterFactory, getRelatedListRecordsBatch_imperative, getRelatedListRecords_imperative, getRelatedListsActions, getRelatedListsActionsAdapterFactory, getRelatedListsActions_imperative, getRelatedListsCount, getRelatedListsCount_imperative, getRelatedListsInfo, getRelatedListsInfoAdapterFactory, getRelatedListsInfo_imperative, getResponseCacheKeys as getResponseCacheKeysContentDocumentCompositeRepresentation, getSearchFilterMetadata, getSearchFilterMetadata_imperative, getSearchFilterOptions, getSearchFilterOptions_imperative, getSearchResults, getSearchResults_imperative, getTypeCacheKeys$X as getTypeCacheKeysRecord, ingest as ingestContentDocumentCompositeRepresentation, ingest$H as ingestObjectInfo, ingest$B as ingestQuickActionExecutionRepresentation, ingest$O as ingestRecord, instrument, isStoreKeyRecordViewEntity, keyBuilder as keyBuilderContentDocumentCompositeRepresentation, keyBuilderFromType as keyBuilderFromTypeContentDocumentCompositeRepresentation, keyBuilderFromType$E as keyBuilderFromTypeRecordRepresentation, keyBuilder$1Y as keyBuilderObjectInfo, keyBuilder$1R as keyBuilderQuickActionExecutionRepresentation, keyBuilder$29 as keyBuilderRecord, notifyAllListInfoSummaryUpdateAvailable, notifyAllListRecordUpdateAvailable, notifyListInfoSummaryUpdateAvailable, notifyListInfoUpdateAvailable, notifyListRecordCollectionUpdateAvailable, notifyListViewSummaryUpdateAvailable, notifyQuickActionDefaultsUpdateAvailable, notifyRecordUpdateAvailable, performQuickAction, performUpdateRecordQuickAction, refresh, registerPrefetcher, updateLayoutUserState, updateListInfoByName, updateListPreferences, updateRecord, updateRecordAvatar, updateRelatedListInfo, updateRelatedListPreferences };
-// version: 1.454.0-761808c4e9
+// version: 1.456.0-6ed480b93c

package/sfdc/uiapi-static-functions.js

@@ -103,7 +103,8 @@ var TypeCheckShapes;
 
 const { keys: ObjectKeys, create: ObjectCreate } = Object;
 
-const { assign, create, freeze, isFrozen, keys } = Object;
+const { assign, create, freeze, getPrototypeOf, isFrozen, keys } = Object;
+const { hasOwnProperty } = Object.prototype;
 
 function isString(value) {
     return typeof value === 'string';
@@ -508,6 +509,24 @@ function isFieldValueRepresentation(unknown) {
     }
     return 'value' in unknown && 'displayValue' in unknown;
 }
+/**
+ * Whether `value` is a plain data object safe to index into as a record's
+ * `fields` map. getField runs as trusted (system-mode) code walking a caller-
+ * supplied dot-path, so indexing into a host/exotic object (e.g. `window`) or
+ * reading a prototype-chain property (e.g. `__proto__`) would let it read host
+ * state on the caller's behalf -- the same class of confused-deputy sandbox
+ * escape fixed for `getSObjectValue` (W-23862210). Record field maps are
+ * JSON-derived plain objects, so we accept only a prototype chain that ends
+ * immediately at an `Object.prototype` (or `null`), which also keeps
+ * cross-realm/membrane records (LWS) valid.
+ */
+function isTraversableFieldsMap(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const proto = getPrototypeOf(value);
+    return proto === null || getPrototypeOf(proto) === null;
+}
 function getField(record, field) {
     const fieldApiName = getFieldApiName(field);
     if (fieldApiName === undefined) {
@@ -517,7 +536,13 @@ function getField(record, field) {
     const fields = unqualifiedField.split('.');
     let r = record;
     while (r && r.fields) {
+        if (isTraversableFieldsMap(r.fields) === false) {
+            return undefined;
+        }
         const f = fields.shift();
+        if (!hasOwnProperty.call(r.fields, f)) {
+            return undefined;
+        }
         const fvr = r.fields[f];
         if (fvr === undefined) {
             return undefined;