From 71bdb8d6567ea010fdf925882407b4f4f14e305f Mon Sep 17 00:00:00 2001 From: Arda TANRIKULU Date: Thu, 13 Mar 2025 15:37:30 +0300 Subject: [PATCH 1/2] Fix for code scanning alert no. 31: Prototype-polluting assignment Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- packages/mock/src/MockStore.ts | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/mock/src/MockStore.ts b/packages/mock/src/MockStore.ts index 8a304826bc6..828cb082807 100644 --- a/packages/mock/src/MockStore.ts +++ b/packages/mock/src/MockStore.ts @@ -263,6 +263,9 @@ export class MockStore implements IMockStore { value = deepResolveMockList(value); } + if (typeName === '__proto__' || typeName === 'constructor' || typeName === 'prototype') { + throw new Error(`Invalid typeName: ${typeName}`); + } if (this.store[typeName] === undefined) { this.store[typeName] = {}; } From dc15aa57546dde831fa19501588d8388394a4813 Mon Sep 17 00:00:00 2001 From: Arda TANRIKULU Date: Thu, 13 Mar 2025 15:39:44 +0300 Subject: [PATCH 2/2] Changeset --- .changeset/tame-papayas-fetch.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/tame-papayas-fetch.md diff --git a/.changeset/tame-papayas-fetch.md b/.changeset/tame-papayas-fetch.md new file mode 100644 index 00000000000..25fc987497d --- /dev/null +++ b/.changeset/tame-papayas-fetch.md @@ -0,0 +1,5 @@ +--- +'@graphql-tools/mock': patch +--- + +Prevent prototype polluting assignment