Prevent accessing response object's prototype chain#3396

Merged

duckki merged 19 commits intomainfrom

duckki/inc-1012

Mar 13, 2026

Commits on Mar 13, 2026

Fix bug in property initialization in `deepMerge()`

sachindshinde
and
duckki
committed
Cleanup previously added prototype manipulation tests, and align them with existing ones
sachindshinde
committed
Move property initialization logic into its own utility function.
sachindshinde
committed
Add tests for prototype manipulation for Operation.collectDefaultedVariableValues().
sachindshinde
committed
Fix bug in Operation.collectDefaultedVariableValues() where it would not use a null-prototype object.
sachindshinde
committed
Fix bug in computeResponse() where it would not use a null-prototype object.
sachindshinde
committed
Add test for prototype manipulation for computeResponse().
sachindshinde
committed
Fix bug in computeResponse() where it would read non-own properties.
sachindshinde
committed
Although not strictly necessary, defensively use getOwn() in executeIntrospection().
sachindshinde
committed
Add test for prototype manipulation when reading provided variables in executeFetch().
sachindshinde
committed
Fix bug in executeFetch() where it would read non-own properties from providedVariables.
sachindshinde
committed
Add test for prototype manipulation when reading variables in evaluateCondition().
sachindshinde
committed
Fix bug in evaluateCondition() where it would read non-own properties from variables.
sachindshinde
committed
Fix bugs in data-rewrite logic called by executeFetch().
sachindshinde
committed
Fix bug in generateHydratedPaths() where it would read non-own properties via the "in" operator.
sachindshinde
committed
Fix bug in executeSelectionSet() where it would read non-own properties for field selections.
sachindshinde
committed
Fix bug in flattenResultsAtPath() where it would read non-own properties when recursing.
sachindshinde
committed
Add changeset

duckki
authored and
sachindshinde
committed
Temporarily add GHSA IDs to cspell, we'll fix it later
sachindshinde
committed