Skip to content

Fix prototype-colliding names in execution values#4653

Open
abishekgiri wants to merge 2 commits intographql:16.x.xfrom
abishekgiri:fix-execution-values-own-property-returns
Open

Fix prototype-colliding names in execution values#4653
abishekgiri wants to merge 2 commits intographql:16.x.xfrom
abishekgiri:fix-execution-values-own-property-returns

Conversation

@abishekgiri
Copy link
Copy Markdown

@abishekgiri abishekgiri commented Apr 2, 2026

Summary

Fixes an issue where prototype-colliding property names (e.g., __proto__, constructor) could interfere with execution value handling.

Changes

  • Ensured own-property checks are used when accessing execution values
  • Prevent potential prototype chain collisions

Motivation

JavaScript objects can inherit properties from the prototype chain. Without proper checks, this can lead to unexpected behavior when handling execution values.

Testing

  • Verified manually with edge-case inputs involving prototype properties
  • Existing tests pass locally

@vercel
Copy link
Copy Markdown

vercel bot commented Apr 2, 2026

@abishekgiri is attempting to deploy a commit to the The GraphQL Foundation Team on Vercel.

A member of the Team first needs to authorize it.

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
@abishekgiri
Copy link
Copy Markdown
Author

Status update

  • Fixed execution/values.ts so getArgumentValues() and getVariableValues() keep their null-prototype maps instead of reintroducing Object.prototype via object spread.
  • Added regression coverage for omitted prototype-colliding names like toString in both resolver args and coerced variable values.
  • Results: targeted mocha, eslint, and prettier checks passed for this change.
  • tsc in this environment still reports existing external errors from ../node_modules/@types/react-dom, which are outside this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant