kinetex 1.0.0 → 1.2.0

package/dist/cjs/client.js

@@ -130,6 +130,40 @@ function randomHex(len) {
 // ============================================================================
 // §3  HAR RECORDER (inline)
 // ============================================================================
+/**
+ * Headers redacted before being written to HAR entries (FIX M2).
+ * Mirrors logging.ts DEFAULT_REDACT_HEADERS — HAR logs are routinely exported
+ * and shared, so credentials must never appear verbatim.
+ */
+const HAR_REDACT_HEADERS = new Set([
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key",
+    "x-auth-token",
+    "x-access-token",
+    "x-refresh-token",
+    "x-csrf-token",
+    "x-session-id",
+    "x-session-token",
+    "x-secret",
+    "x-secret-key",
+    "x-private-key",
+    "api-key",
+    "apikey",
+    "bearer",
+    "token",
+    "authentication",
+    "credentials",
+    "password",
+    "passwd",
+    "secret",
+]);
+/** Redact a single header value for HAR output. */
+function redactHARHeader(name, value) {
+    return HAR_REDACT_HEADERS.has(name.toLowerCase()) ? { name, value: "***REDACTED***" } : { name, value };
+}
 /**
  * O(1) ring-buffer HAR entry recorder.
  * Stores up to `maxEntries` entries, evicting oldest first.
@@ -192,7 +226,7 @@ class HARRecorder {
                 method: req.method,
                 url: req.url,
                 httpVersion: res.httpVersion,
-                headers: Object.entries(req.headers).map(([name, value]) => ({ name, value })),
+                headers: Object.entries(req.headers).map(([name, value]) => redactHARHeader(name, value)),
                 queryString: (() => {
                     try {
                         return Array.from(new URL(req.url).searchParams.entries()).map(([name, value]) => ({
@@ -220,7 +254,7 @@ class HARRecorder {
                 status: res.status,
                 statusText: res.statusText,
                 httpVersion: res.httpVersion,
-                headers: Object.entries(res.headers).map(([name, value]) => ({ name, value })),
+                headers: Object.entries(res.headers).map(([name, value]) => redactHARHeader(name, value)),
                 content: {
                     size: res.rawBody?.byteLength ?? 0,
                     mimeType: res.headers["content-type"] ?? "application/octet-stream",
@@ -279,7 +313,14 @@ async function applyAuth(req, auth) {
     switch (auth.type) {
         case "bearer": {
             const token = typeof auth.token === "function" ? await auth.token() : auth.token;
-            headers["authorization"] = `Bearer ${token}`;
+            // FIX (H3): token values — especially from async providers — must be
+            // validated before injection. A token containing CRLF would split or
+            // forge headers on the wire (header injection).
+            const headerValue = `Bearer ${token}`;
+            if (!isValidHeaderValue(headerValue)) {
+                throw new KinetexError("Invalid bearer token — contains forbidden characters (CRLF/CTL)", "EVALIDATION");
+            }
+            headers["authorization"] = headerValue;
             break;
         }
         case "basic": {
@@ -303,7 +344,17 @@ async function applyAuth(req, auth) {
         }
         case "apikey": {
             const key = typeof auth.key === "function" ? await auth.key() : auth.key;
-            headers[auth.header.toLowerCase()] = key;
+            // FIX (LOW): validate the custom header name — an apikey header containing
+            // CRLF or spaces would be injected verbatim into the request.
+            if (!isValidHeaderName(auth.header)) {
+                throw new KinetexError(`Invalid apikey auth header name: "${auth.header}"`, "EVALIDATION");
+            }
+            // FIX (H3): the key value is equally attacker-influenced when provided
+            // via an async provider — validate before injection.
+            if (!isValidHeaderValue(String(key))) {
+                throw new KinetexError(`Invalid apikey value for "${auth.header}" — contains forbidden characters`, "EVALIDATION");
+            }
+            headers[auth.header.toLowerCase()] = String(key);
             break;
         }
         case "digest": {
@@ -328,6 +379,46 @@ async function applyAuth(req, auth) {
 // ============================================================================
 // §5  URL BUILDING
 // ============================================================================
+/**
+ * Headers stripped when a redirect crosses origins (FIX H2).
+ * These carry credentials and must never be forwarded to a different origin.
+ */
+const CROSS_ORIGIN_STRIP_HEADERS = new Set([
+    "authorization",
+    "cookie",
+    "proxy-authorization",
+    "x-api-key",
+    "x-auth-token",
+    "x-access-token",
+    "x-refresh-token",
+    "x-csrf-token",
+    "x-session-id",
+    "x-session-token",
+    "x-secret",
+    "x-secret-key",
+    "x-private-key",
+    "api-key",
+    "apikey",
+    "www-authenticate",
+]);
+/**
+ * Strip userinfo (user:pass@) from a URL string for safe error messages (FIX M5).
+ * Falls back to a regex strip when the URL cannot be parsed.
+ */
+function redactUserInfo(url) {
+    try {
+        const u = new URL(url);
+        if (u.username || u.password) {
+            u.username = "";
+            u.password = "";
+            return u.toString();
+        }
+        return url;
+    }
+    catch {
+        return url.replace(/\/\/[^/@]*@/, "//");
+    }
+}
 /**
  * Resolve a URL against an optional base and append query parameters.
  * Rejects unsafe URLs (private/loopback addresses). Enforces query param
@@ -368,7 +459,7 @@ function buildURL(base, url, params) {
     }
     if (!params || Object.keys(params).length === 0) {
         if (!isSafeURL(full)) {
-            throw new KinetexError(`URL "${full}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
+            throw new KinetexError(`URL "${redactUserInfo(full)}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
         }
         return full;
     }
@@ -405,7 +496,7 @@ function buildURL(base, url, params) {
         }
         // Validate the final URL with params
         if (!isSafeURL(result)) {
-            throw new KinetexError(`URL "${result}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
+            throw new KinetexError(`URL "${redactUserInfo(result)}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
         }
         return result;
     }
@@ -448,6 +539,11 @@ function buildURL(base, url, params) {
         if (result.length > MAX_URL_LENGTH) {
             throw new KinetexError(`URL length ${result.length} bytes exceeds limit of ${MAX_URL_LENGTH} bytes`, "EVALIDATION");
         }
+        // FIX M4: the manual param-concat fallback previously returned WITHOUT a
+        // safety check — validate the assembled URL like every other path.
+        if (!isSafeURL(result)) {
+            throw new KinetexError(`URL "${redactUserInfo(result)}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
+        }
         return result;
     }
 }
@@ -1293,6 +1389,16 @@ export class Kinetex {
         }
         // ── Build initial request ─────────────────────────────────────────────
         const fullUrl = buildURL(options.baseURL ?? this.cfg.baseURL, url, mergeParams(this.cfg.params, options.params));
+        // FIX (M7): proxy configuration was stored but never consumed — a silent
+        // no-op that sent traffic directly to the target, bypassing the user's
+        // proxy entirely. Fail fast with actionable guidance instead.
+        const proxy = options.proxy ?? this.cfg.proxy;
+        if (proxy) {
+            throw new KinetexError("proxy is configured but kinetex's built-in transports cannot route through it: " +
+                "HTTP(S) proxies require a custom fetch with a proxy agent (e.g. undici ProxyAgent " +
+                "passed via the `fetch` option), and SOCKS5 requires createSocks5Tunnel() from " +
+                "kinetex/socks5. Set up one of those instead of relying on `proxy` silently doing nothing.", "EVALIDATION");
+        }
         // Enforce HTTPS-only if configured
         if (this.cfg.httpsOnly) {
             try {
@@ -1323,12 +1429,39 @@ export class Kinetex {
             else if (options.body instanceof Blob) {
                 bodySize = options.body.size;
             }
+            else if (ArrayBuffer.isView(options.body)) {
+                // FIX (H4): other typed-array/DataView views were uncounted.
+                // ArrayBuffer.isView() is used instead of `instanceof ArrayBufferView`
+                // because there is no runtime global to instanceof against.
+                bodySize = options.body.byteLength;
+            }
+            else if (options.body instanceof URLSearchParams) {
+                // FIX (H4): previously silently skipped — count the serialized form.
+                bodySize = new TextEncoder().encode(options.body.toString()).byteLength;
+            }
             else if (options.body instanceof FormData) {
-                // FormData size estimation is complex, skip for now
-                // In practice, browsers enforce their own limits
+                // FIX (H4): estimate multipart size instead of skipping entirely —
+                // the old skip allowed unbounded uploads past the configured limit.
+                const boundaryOverhead = 76; // per part: --boundary, headers, CRLF (conservative)
+                for (const [name, value] of options.body) {
+                    bodySize += new TextEncoder().encode(name).byteLength + boundaryOverhead;
+                    if (typeof value === "string") {
+                        bodySize += new TextEncoder().encode(value).byteLength;
+                    }
+                    else {
+                        bodySize += value.size;
+                    }
+                }
+                bodySize += boundaryOverhead; // final boundary
+            }
+            else if (options.body instanceof ReadableStream) {
+                // FIX (H4): a stream's size cannot be known without consuming it —
+                // reject rather than silently bypassing the limit. Callers who need
+                // streaming uploads must pass maxRequestSize: 0 explicitly.
+                throw new KinetexError(`maxRequestSize cannot be enforced for ReadableStream bodies — pass maxRequestSize: 0 to opt out, or buffer the body first`, "EVALIDATION");
             }
             else if (options.body && typeof options.body === "object") {
-                bodySize = JSON.stringify(options.body).length;
+                bodySize = new TextEncoder().encode(JSON.stringify(options.body)).byteLength;
             }
             if (bodySize > maxRequestSize) {
                 throw new KinetexError(`Request body size ${bodySize} bytes exceeds limit of ${maxRequestSize} bytes`, "EVALIDATION");
@@ -1559,12 +1692,33 @@ export class Kinetex {
     async _sendFollowingRedirects(req, timeout, jar, appliedAuth) {
         const MAX_REDIRECTS = 20;
         let currentReq = { ...req, redirect: "manual" };
+        const origin0 = (() => {
+            try {
+                return new URL(req.url).origin;
+            }
+            catch {
+                return null;
+            }
+        })();
         // Track visited URLs to detect redirect loops
         const visited = new Set();
         for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-            // Apply auth headers on every hop (they may have been lost during redirect)
+            // FIX H2 (part 2): re-apply auth on every hop ONLY while we remain on the
+            // original origin. Once a redirect has crossed origins, credential-bearing
+            // headers must not be re-injected — otherwise the cross-origin strip in
+            // the redirect branch below would be immediately undone.
             if (hop > 0 && appliedAuth) {
-                currentReq = await applyAuth(currentReq, appliedAuth);
+                const sameOrigin = (() => {
+                    try {
+                        return new URL(currentReq.url).origin === origin0;
+                    }
+                    catch {
+                        return false;
+                    }
+                })();
+                if (sameOrigin) {
+                    currentReq = await applyAuth(currentReq, appliedAuth);
+                }
             }
             // Fire request interceptors and onBeforeRequest hooks on every hop
             // so auth headers, logging, and tracing apply to redirect legs too.
@@ -1656,6 +1810,21 @@ export class Kinetex {
                 else {
                     delete nextHeaders["cookie"];
                 }
+                // FIX H2: When the redirect crosses origins, strip credential-bearing
+                // headers (Authorization, Cookie, proxy auth, API keys) so secrets are
+                // never forwarded to a different origin (RFC 9110 7.1 semantics).
+                // Cookies for the new origin are re-established by the jar lookup above;
+                // jar scoping guarantees only same-site cookies apply.
+                try {
+                    if (new URL(nextUrl).origin !== new URL(currentReq.url).origin) {
+                        for (const h of CROSS_ORIGIN_STRIP_HEADERS) {
+                            delete nextHeaders[h];
+                        }
+                    }
+                }
+                catch {
+                    /* nextUrl was already validated above */
+                }
                 currentReq = {
                     ...currentReq,
                     url: nextUrl,

package/dist/cjs/cookie-store.js

@@ -311,6 +311,16 @@ export class CookieJar {
                     // §5.4 step 2e: SameSite
                     if (!sameSiteAllows(cookie.sameSite, context))
                         continue;
+                    // FIX (H5): defense-in-depth — re-validate __Secure-/__Host- prefix
+                    // rules at retrieval time. Set-time enforcement (enforcePrefixRules)
+                    // is the RFC rule, but storage can be rehydrated via loadCookieJar
+                    // from external JSON, so never emit a prefix cookie whose Secure/
+                    // Path/hostOnly flags no longer satisfy the contract.
+                    if (cookie.name.startsWith("__Secure-") && !(cookie.secure && isSecure))
+                        continue;
+                    if (cookie.name.startsWith("__Host-") &&
+                        !(cookie.secure && isSecure && cookie.path === "/" && cookie.hostOnly))
+                        continue;
                     result.push(cookie);
                 }
             }

package/dist/cjs/core.js

@@ -248,6 +248,8 @@ export class NodeHTTP2Transport {
     sessionUsage = new Map();
     _strict;
     _onDroppedHeader;
+    /** Optional CA bundle for origins with self-signed / private-PKI certificates. */
+    _ca;
     /** FIX 11: Configurable connect timeout (replaces hardcoded 30 000 ms) */
     _connectTimeoutMs;
     /** FIX 11: Configurable per-request stream timeout (replaces hardcoded 30 000 ms) */
@@ -263,6 +265,7 @@ export class NodeHTTP2Transport {
         this.maxSessions = options.maxSessions ?? 100;
         this._strict = options.strict ?? false;
         this._onDroppedHeader = options.onDroppedHeader;
+        this._ca = options.ca;
         this._connectTimeoutMs = options.connectTimeoutMs ?? 30_000;
         this._requestTimeoutMs = options.requestTimeoutMs ?? 30_000;
     }
@@ -323,7 +326,10 @@ export class NodeHTTP2Transport {
             }
         }
         const session = await new Promise((resolve, reject) => {
-            const s = http2.connect(origin, { rejectUnauthorized: true });
+            const s = http2.connect(origin, {
+                rejectUnauthorized: true,
+                ...(this._ca !== undefined ? { ca: this._ca } : {}),
+            });
             // FIX 11: use configurable connect timeout instead of hardcoded 30 000 ms
             // FIX 9: unref() the timer so it does not prevent process exit
             const connectTimeout = setTimeout(() => {
@@ -451,29 +457,38 @@ export class NodeHTTP2Transport {
                 ":authority": currentUrl.host,
                 ...currentReq.headers,
             };
-            // Strict-mode header validation (HTTP/2 control-character check)
-            if (this._strict) {
-                for (const [hName, hValue] of Object.entries(h2ReqHeaders)) {
-                    if (hName.startsWith(":"))
-                        continue;
-                    const hStr = Array.isArray(hValue) ? hValue.join(", ") : String(hValue);
-                    let hasForbidden = false;
-                    for (let ci = 0; ci < hStr.length; ci++) {
-                        const code = hStr.charCodeAt(ci);
-                        if ((code >= 0x00 && code <= 0x08) || (code >= 0x0a && code <= 0x1f) || code === 0x7f) {
-                            hasForbidden = true;
-                            break;
-                        }
+            // Header validation (HTTP/2 control-character check). Runs in BOTH modes:
+            // strict throws, non-strict drops with callback/warn — matching the
+            // FetchTransport contract. (Previously the whole loop was gated on
+            // strict mode, so non-strict requests never validated and a header with
+            // forbidden control characters crashed session.request() with a raw
+            // ERR_INVALID_HEADER_VALUE instead of being dropped.)
+            for (const [hName, hValue] of Object.entries(h2ReqHeaders)) {
+                if (hName.startsWith(":"))
+                    continue;
+                const hStr = Array.isArray(hValue) ? hValue.join(", ") : String(hValue);
+                let hasForbidden = false;
+                for (let ci = 0; ci < hStr.length; ci++) {
+                    const code = hStr.charCodeAt(ci);
+                    if ((code >= 0x00 && code <= 0x08) || (code >= 0x0a && code <= 0x1f) || code === 0x7f) {
+                        hasForbidden = true;
+                        break;
+                    }
+                }
+                if (hasForbidden) {
+                    if (this._strict) {
+                        throw new KinetexError(`Strict mode: header "${hName}" contains forbidden control characters`, "EVALIDATION", { request: currentReq });
                     }
-                    if (hasForbidden) {
-                        if (this._onDroppedHeader) {
-                            this._onDroppedHeader(hName, hStr);
-                            delete h2ReqHeaders[hName];
-                        }
-                        else {
-                            throw new KinetexError(`Strict mode: header "${hName}" contains forbidden control characters`, "EVALIDATION", { request: currentReq });
-                        }
+                    // FIX (H3): non-strict mode must match FetchTransport behavior —
+                    // notify the callback (if any) and warn, never drop silently.
+                    if (this._onDroppedHeader) {
+                        this._onDroppedHeader(hName, hStr);
                     }
+                    else if (typeof console !== "undefined") {
+                        console.warn(`[kinetex] Invalid header dropped (HTTP/2): "${hName}" — value contains illegal control characters. ` +
+                            `Pass strictHeaders: true to throw instead.`);
+                    }
+                    delete h2ReqHeaders[hName];
                 }
             }
             const endStream = !currentReq.body || currentReq.method === "GET" || currentReq.method === "HEAD";
@@ -713,9 +728,14 @@ export class NodeHTTP2Transport {
  * @param transportOptions - Header validation options (strict mode, dropped-header callback).
  */
 export function createTransport(fetchFn, preferHTTP2 = true, sessionOptions, transportOptions) {
-    // Use NodeHTTP2Transport for Node.js when HTTP/2 is preferred
-    // Falls back to FetchTransport for HTTP/1.1 or non-Node runtimes
-    if (IS_NODE && preferHTTP2) {
+    // FIX (M7-class silent no-op): a custom `fetch` config was silently ignored on
+    // Node.js when HTTP/2 was preferred (the default) — NodeHTTP2Transport has no
+    // fetchFn input, so the caller's fetch was never used. When a custom fetch is
+    // supplied, always route through FetchTransport so the documented
+    // "Custom fetch implementation" behavior holds on every runtime.
+    // Use NodeHTTP2Transport for Node.js when HTTP/2 is preferred and no custom
+    // fetch is given. Falls back to FetchTransport otherwise.
+    if (IS_NODE && preferHTTP2 && !fetchFn) {
         return new NodeHTTP2Transport({
             ...(sessionOptions?.sessionTTLMs !== undefined
                 ? { sessionTTLMs: sessionOptions.sessionTTLMs }
@@ -767,8 +787,14 @@ export async function sendWithTimeout(transport, request, timeoutMs) {
     // Merge signals
     const signal = mergeSignals(request.signal, controller.signal) ?? null;
     const req = { ...request, signal };
+    const timeoutPromise = new Promise((_, reject) => {
+        controller.signal.addEventListener("abort", () => reject(new TimeoutError(timeoutMs, request)), { once: true });
+    });
     try {
-        const result = await transport.send(req);
+        // Race the transport against the timer. The race is the actual deadline
+        // — a transport that never resolves (or ignores the abort signal) can no
+        // longer hang the caller past timeoutMs.
+        const result = await Promise.race([transport.send(req), timeoutPromise]);
         clearTimeout(timer);
         // Safety net: the transport may have resolved despite the abort signal
         // (e.g. Node.js HTTP/2 'close' fires before 'error' in some versions).
@@ -780,7 +806,7 @@ export async function sendWithTimeout(transport, request, timeoutMs) {
     }
     catch (err) {
         clearTimeout(timer);
-        if (controller.signal.aborted) {
+        if (controller.signal.aborted && !(err instanceof TimeoutError)) {
             throw new TimeoutError(timeoutMs, request);
         }
         throw err;

package/dist/cjs/graphql.js

@@ -27,6 +27,9 @@
  *  - Retry on network error
  */
 import { ValidationError } from "./types.js";
+// FIX (H6): untrusted GraphQL responses are parsed with raw JSON.parse below —
+// sanitize prototype-pollution keys before they reach user code or merges.
+import { sanitizeParsedJSON } from "./utils.js";
 // ============================================================================
 // §2  ERRORS
 // ============================================================================
@@ -307,11 +310,20 @@ function setNestedValue(obj, path, value) {
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const key = parts[i];
+        // FIX (H6): reject prototype-pollution path segments — a GraphQL upload
+        // path like "__proto__.polluted" must never write through the prototype.
+        if (key === "__proto__" || key === "constructor" || key === "prototype") {
+            throw new ValidationError(`Invalid upload path: "${path}" — reserved key "${key}"`);
+        }
         if (!current[key] || typeof current[key] !== "object")
             current[key] = {};
         current = current[key];
     }
-    current[parts[parts.length - 1]] = value;
+    const leaf = parts[parts.length - 1];
+    if (leaf === "__proto__" || leaf === "constructor" || leaf === "prototype") {
+        throw new ValidationError(`Invalid upload path: "${path}" — reserved key "${leaf}"`);
+    }
+    current[leaf] = value;
 }
 // ============================================================================
 // §8  RESPONSE HANDLING
@@ -324,7 +336,8 @@ async function parseGraphQLResponse(response, req) {
     }
     let json;
     try {
-        json = (await response.json());
+        // FIX (H6): sanitize untrusted response JSON before it reaches user code.
+        json = sanitizeParsedJSON((await response.json()));
     }
     catch (err) {
         throw new GraphQLClientError("Failed to parse GraphQL response as JSON", "EPARSE", undefined, req, undefined, err);
@@ -370,8 +383,10 @@ async function executeHTTP(req, config, signal, apqMode = "none", getAPQHashFn)
         fetchHeaders["content-type"] = "application/json";
     const controller = new AbortController();
     const timer = config.timeoutMs > 0 ? setTimeout(() => controller.abort(), config.timeoutMs) : null;
-    // Merge external signal
-    signal?.addEventListener("abort", () => controller.abort(), { once: true });
+    // Merge external signal. The listener is removed once the fetch settles so
+    // it does not accumulate on long-lived caller-provided signals (leak fix).
+    const onExternalAbort = () => controller.abort();
+    signal?.addEventListener("abort", onExternalAbort, { once: true });
     let response;
     try {
         response = await config.fetch(fetchUrl, {
@@ -392,6 +407,7 @@ async function executeHTTP(req, config, signal, apqMode = "none", getAPQHashFn)
     finally {
         if (timer)
             clearTimeout(timer);
+        signal?.removeEventListener("abort", onExternalAbort);
     }
     return parseGraphQLResponse(response, req);
 }
@@ -621,7 +637,10 @@ export class GraphQLClient {
         delete headers["content-type"]; // FormData sets it with boundary
         const form = buildMultipartBody(req, uploads);
         const controller = new AbortController();
-        options.signal?.addEventListener("abort", () => controller.abort(), { once: true });
+        // Listener removed when the fetch settles — avoids accumulating on the
+        // caller's signal across many uploads (leak fix).
+        const onExternalAbort = () => controller.abort();
+        options.signal?.addEventListener("abort", onExternalAbort, { once: true });
         this.config.onRequest(req);
         let response;
         try {
@@ -637,6 +656,9 @@ export class GraphQLClient {
             this.config.onError(clientErr, req);
             throw clientErr;
         }
+        finally {
+            options.signal?.removeEventListener("abort", onExternalAbort);
+        }
         const gqlRes = await parseGraphQLResponse(response, req);
         this.config.onResponse(gqlRes, req);
         if (gqlRes.errors?.length) {
@@ -666,7 +688,10 @@ export class GraphQLClient {
     async batch(requests, options = {}) {
         const headers = await buildHeaders(this.config);
         const controller = new AbortController();
-        options.signal?.addEventListener("abort", () => controller.abort(), { once: true });
+        // Listener removed when the fetch settles — avoids accumulating on the
+        // caller's signal across many batches (leak fix).
+        const onExternalAbort = () => controller.abort();
+        options.signal?.addEventListener("abort", onExternalAbort, { once: true });
         let response;
         try {
             response = await this.config.fetch(this.config.url, {
@@ -679,7 +704,11 @@ export class GraphQLClient {
         catch (err) {
             throw new GraphQLClientError(err instanceof Error ? err.message : "Batch network error", "ENETWORK", undefined, requests[0], undefined, err);
         }
-        const rawResults = await response.json();
+        finally {
+            options.signal?.removeEventListener("abort", onExternalAbort);
+        }
+        // FIX (H6): sanitize untrusted batch response JSON before validation.
+        const rawResults = sanitizeParsedJSON(await response.json());
         // Validate response is array (B-5 fix)
         if (!Array.isArray(rawResults)) {
             throw new GraphQLClientError("Batch response must be an array of GraphQL responses", "EINVALIDRESPONSE", undefined, requests[0], rawResults);
@@ -771,7 +800,7 @@ export class GraphQLClient {
                 continue;
             let gqlRes;
             try {
-                gqlRes = JSON.parse(event.data);
+                gqlRes = sanitizeParsedJSON(JSON.parse(event.data));
             }
             catch {
                 continue;

package/dist/cjs/interceptors.js

@@ -513,33 +513,43 @@ export function createTimeoutInterceptor(config = {}) {
             ctx.aborted = true;
             controller.abort(new TimeoutError(cfg.message, ms));
         }, ms);
-        // Merge with any existing signal
+        // Merge with any existing signal. The listener is removed in the
+        // response/error cleanup below so a shared external signal does not
+        // accumulate one closure per request (leak fix).
         const existing = ctx.request.signal;
         if (existing) {
-            existing.addEventListener("abort", () => {
+            const onExistingAbort = () => {
                 clearTimeout(timer);
                 controller.abort(existing.reason);
-            }, { once: true });
+            };
+            existing.addEventListener("abort", onExistingAbort, { once: true });
+            ctx.store.set(TIMEOUT_SIGNAL_KEY, { existing, onExistingAbort });
         }
         ctx.request = { ...ctx.request, signal: controller.signal };
         // Store cleanup ref in context
         ctx.store.set(TIMEOUT_TIMER_KEY, timer);
     };
-    // Response interceptor cleans up the timer after request completes
-    const responseInterceptor = (ctx) => {
+    /** Shared cleanup for the response and error phases. */
+    const cleanupTimeout = (ctx) => {
         const timer = ctx.store.get(TIMEOUT_TIMER_KEY);
         if (timer) {
             clearTimeout(timer);
             ctx.store.delete(TIMEOUT_TIMER_KEY);
         }
+        const merged = ctx.store.get(TIMEOUT_SIGNAL_KEY);
+        if (merged) {
+            merged.existing.removeEventListener("abort", merged.onExistingAbort);
+            ctx.store.delete(TIMEOUT_SIGNAL_KEY);
+        }
     };
-    // Error interceptor also cleans up the timer
+    // Response interceptor cleans up the timer and merged-signal listener after
+    // the request completes
+    const responseInterceptor = (ctx) => {
+        cleanupTimeout(ctx);
+    };
+    // Error interceptor also cleans up the timer and merged-signal listener
     const errorInterceptor = (ctx) => {
-        const timer = ctx.store.get(TIMEOUT_TIMER_KEY);
-        if (timer) {
-            clearTimeout(timer);
-            ctx.store.delete(TIMEOUT_TIMER_KEY);
-        }
+        cleanupTimeout(ctx);
     };
     return {
         id: "timeout",
@@ -549,6 +559,7 @@ export function createTimeoutInterceptor(config = {}) {
     };
 }
 const TIMEOUT_TIMER_KEY = Symbol("timeoutTimer");
+const TIMEOUT_SIGNAL_KEY = Symbol("timeoutSignal");
 /** Error thrown when a request exceeds the configured timeout. */
 export class TimeoutError extends Error {
     timeoutMs;

package/dist/cjs/logging.js

@@ -25,6 +25,9 @@
  * consider using external log rotation (e.g., logrotate) or shipping logs
  * to a remote service (RemoteTransport) rather than writing to files.
  */
+// FIX (H6): logged bodies are untrusted — parsed JSON is stripped of
+// prototype-pollution keys before redaction writes (see sanitizeParsedJSON).
+import { sanitizeParsedJSON } from "./utils.js";
 // Cross-runtime: safely detect Node.js process.env
 const getNodeEnv = () => {
     try {
@@ -483,7 +486,9 @@ export class Redactor {
         // Redact body fields (JSON)
         if (ct.includes("application/json") && this.bodyFields.length > 0) {
             try {
-                const parsed = JSON.parse(str);
+                // FIX (H6): log bodies are untrusted — sanitize before mutation so a
+                // crafted payload cannot smuggle __proto__ paths into redaction writes.
+                const parsed = sanitizeParsedJSON(JSON.parse(str));
                 for (const path of this.bodyFields)
                     redactObjectPath(parsed, path.split("."));
                 str = JSON.stringify(parsed);
@@ -510,9 +515,12 @@ function redactObjectPath(obj, path) {
     const [head, ...rest] = path;
     if (head === undefined)
         return;
+    // FIX (H6): never traverse or write through prototype-pollution keys.
+    if (head === "__proto__" || head === "constructor" || head === "prototype")
+        return;
     const o = obj;
     if (rest.length === 0) {
-        if (head in o)
+        if (Object.prototype.hasOwnProperty.call(o, head))
             o[head] = "***";
         return;
     }