vulnerability

ardatan · Aug 9, 2023 · b413f77 · b413f77
1 parent 850d8af
commit b413f77
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/packages/delegate/src/mergeFields.ts b/packages/delegate/src/mergeFields.ts
@@ -137,6 +137,9 @@ function handleResolverResult(
   const objectSubschema = resolverResult[OBJECT_SUBSCHEMA_SYMBOL];
   const fieldSubschemaMap = resolverResult[FIELD_SUBSCHEMA_MAP_SYMBOL];
   for (const responseKey in resolverResult) {
+    if (responseKey === '__proto__') {
+      continue;
+    }
     const existingPropValue = object[responseKey];
     const sourcePropValue = resolverResult[responseKey];
     if (sourcePropValue != null || existingPropValue == null) {