@salesforce/lwc-adapters-uiapi 1.454.0 → 1.456.0

package/dist/main.js

@@ -7813,7 +7813,7 @@ function buildAdapterValidationConfig(displayName, paramsMeta) {
 }
 const keyPrefix = 'UiApi';
 
-const { assign, create, freeze, isFrozen, keys } = Object;
+const { assign, create, freeze, getPrototypeOf, isFrozen, keys } = Object;
 const { hasOwnProperty } = Object.prototype;
 const { split, endsWith } = String.prototype;
 const { isArray } = Array;
@@ -11075,6 +11075,24 @@ function isFieldValueRepresentation(unknown) {
     }
     return 'value' in unknown && 'displayValue' in unknown;
 }
+/**
+ * Whether `value` is a plain data object safe to index into as a record's
+ * `fields` map. getField runs as trusted (system-mode) code walking a caller-
+ * supplied dot-path, so indexing into a host/exotic object (e.g. `window`) or
+ * reading a prototype-chain property (e.g. `__proto__`) would let it read host
+ * state on the caller's behalf -- the same class of confused-deputy sandbox
+ * escape fixed for `getSObjectValue` (W-23862210). Record field maps are
+ * JSON-derived plain objects, so we accept only a prototype chain that ends
+ * immediately at an `Object.prototype` (or `null`), which also keeps
+ * cross-realm/membrane records (LWS) valid.
+ */
+function isTraversableFieldsMap(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const proto = getPrototypeOf(value);
+    return proto === null || getPrototypeOf(proto) === null;
+}
 function getField(record, field) {
     const fieldApiName = getFieldApiName(field);
     if (fieldApiName === undefined) {
@@ -11084,7 +11102,13 @@ function getField(record, field) {
     const fields = unqualifiedField.split('.');
     let r = record;
     while (r && r.fields) {
+        if (isTraversableFieldsMap(r.fields) === false) {
+            return undefined;
+        }
         const f = fields.shift();
+        if (!hasOwnProperty.call(r.fields, f)) {
+            return undefined;
+        }
         const fvr = r.fields[f];
         if (fvr === undefined) {
             return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lwc-adapters-uiapi",
-    "version": "1.454.0",
+    "version": "1.456.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "UIAPI adapters with LWC bindings",
     "module": "dist/main.js",
@@ -31,10 +31,10 @@
         "clean": "rm -rf dist src/generated"
     },
     "devDependencies": {
-        "@salesforce/lds-adapters-uiapi": "^1.454.0"
+        "@salesforce/lds-adapters-uiapi": "^1.456.0"
     },
     "dependencies": {
         "@luvio/lwc-luvio": "0.161.2",
-        "@salesforce/lds-default-luvio": "^1.454.0"
+        "@salesforce/lds-default-luvio": "^1.456.0"
     }
 }