Skip to content

fix: prevent prototype pollution through graphql#7964

Merged
BridgeAR merged 1 commit intomasterfrom
BridgeAR/2026-04-09-fix-graphql-security-issue
Apr 9, 2026
Merged

fix: prevent prototype pollution through graphql#7964
BridgeAR merged 1 commit intomasterfrom
BridgeAR/2026-04-09-fix-graphql-security-issue

Conversation

@BridgeAR
Copy link
Copy Markdown
Member

@BridgeAR BridgeAR commented Apr 9, 2026

This was brought up by @zbrydon who also suggested a fix. This includes that fix and it adds additional safeguards.

Closes: #7902

Co-authored-by: Zac Brydon @zbrydon

This was brought up by @zbrydon who also suggested a fix.
This includes that fix and it adds additional safeguards.

Closes: #7902

Co-authored-by: Zac Brydon @zbrydon
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 9, 2026

Overall package size

Self size: 5.47 MB
Deduped: 6.32 MB
No deduping: 6.32 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.0.1 | 82.56 kB | 817.39 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 9, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.85%. Comparing base (9ed88dc) to head (cf3221f).

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #7964   +/-   ##
=======================================
  Coverage   73.85%   73.85%           
=======================================
  Files         773      773           
  Lines       35959    35959           
=======================================
  Hits        26558    26558           
  Misses       9401     9401           
Flag Coverage Δ
aiguard-macos 36.39% <100.00%> (-0.09%) ⬇️
aiguard-ubuntu 36.50% <100.00%> (-0.09%) ⬇️
aiguard-windows 36.29% <100.00%> (-0.09%) ⬇️
apm-capabilities-tracing-macos 48.83% <50.00%> (-0.01%) ⬇️
apm-capabilities-tracing-ubuntu 48.87% <50.00%> (ø)
apm-capabilities-tracing-windows 48.65% <50.00%> (-0.01%) ⬇️
apm-integrations-child-process 36.03% <100.00%> (-0.10%) ⬇️
apm-integrations-couchbase-18 35.00% <100.00%> (-0.07%) ⬇️
apm-integrations-couchbase-eol 35.05% <100.00%> (-0.07%) ⬇️
apm-integrations-oracledb 35.03% <100.00%> (-0.09%) ⬇️
appsec-express 52.86% <100.00%> (-0.06%) ⬇️
appsec-fastify 49.33% <100.00%> (-0.07%) ⬇️
appsec-graphql 49.57% <100.00%> (-0.16%) ⬇️
appsec-kafka 42.09% <100.00%> (-0.08%) ⬇️
appsec-ldapjs 41.41% <100.00%> (-0.08%) ⬇️
appsec-lodash 41.44% <100.00%> (-0.08%) ⬇️
appsec-macos 56.78% <100.00%> (-0.07%) ⬇️
appsec-mongodb-core 46.01% <100.00%> (-0.11%) ⬇️
appsec-mongoose 46.65% <100.00%> (-0.07%) ⬇️
appsec-mysql 48.79% <100.00%> (-0.07%) ⬇️
appsec-node-serialize 40.60% <100.00%> (-0.08%) ⬇️
appsec-passport 44.62% <100.00%> (-0.08%) ⬇️
appsec-postgres 48.37% <100.00%> (-0.19%) ⬇️
appsec-sourcing 40.06% <100.00%> (-0.08%) ⬇️
appsec-stripe 42.32% <100.00%> (-0.08%) ⬇️
appsec-template 40.77% <100.00%> (-0.08%) ⬇️
appsec-ubuntu 56.86% <100.00%> (-0.07%) ⬇️
appsec-windows 56.67% <100.00%> (-0.05%) ⬇️
instrumentations-instrumentation-bluebird 29.90% <100.00%> (-0.10%) ⬇️
instrumentations-instrumentation-body-parser 37.65% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-child_process 35.41% <100.00%> (-0.10%) ⬇️
instrumentations-instrumentation-cookie-parser 31.84% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-express 32.14% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-express-mongo-sanitize 31.97% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-express-session 37.31% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-fs 29.54% <100.00%> (-0.10%) ⬇️
instrumentations-instrumentation-generic-pool 31.44% <ø> (ø)
instrumentations-instrumentation-http 36.86% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-knex 29.92% <100.00%> (-0.10%) ⬇️
instrumentations-instrumentation-mongoose 31.03% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-multer 37.42% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-mysql2 35.39% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-passport 41.24% <100.00%> (-0.08%) ⬇️
instrumentations-instrumentation-passport-http 40.94% <100.00%> (-0.08%) ⬇️
instrumentations-instrumentation-passport-local 41.43% <100.00%> (-0.08%) ⬇️
instrumentations-instrumentation-pg 34.89% <100.00%> (-0.09%) ⬇️
instrumentations-instrumentation-promise 29.84% <100.00%> (-0.10%) ⬇️
instrumentations-instrumentation-promise-js 29.84% <100.00%> (-0.10%) ⬇️
instrumentations-instrumentation-q 29.88% <100.00%> (-0.10%) ⬇️
instrumentations-instrumentation-url 29.81% <100.00%> (-0.10%) ⬇️
instrumentations-instrumentation-when 29.85% <100.00%> (-0.10%) ⬇️
llmobs-ai 38.28% <100.00%> (-0.09%) ⬇️
llmobs-anthropic 37.87% <100.00%> (-0.09%) ⬇️
llmobs-bedrock 37.16% <100.00%> (-0.08%) ⬇️
llmobs-google-genai 37.55% <100.00%> (-0.08%) ⬇️
llmobs-langchain 37.16% <100.00%> (+0.03%) ⬆️
llmobs-openai 41.24% <100.00%> (-0.08%) ⬇️
llmobs-vertex-ai 37.72% <100.00%> (-0.09%) ⬇️
platform-core 30.82% <ø> (ø)
platform-esbuild 33.74% <ø> (ø)
platform-instrumentations-misc 40.89% <ø> (ø)
platform-shimmer 36.80% <ø> (ø)
platform-unit-guardrails 32.24% <ø> (ø)
platform-webpack 20.96% <ø> (ø)
plugins-azure-durable-functions 25.38% <ø> (ø)
plugins-azure-event-hubs 25.53% <ø> (ø)
plugins-azure-service-bus 24.92% <ø> (ø)
plugins-bullmq 40.71% <100.00%> (-0.08%) ⬇️
plugins-cassandra 35.18% <100.00%> (-0.09%) ⬇️
plugins-cookie 26.56% <ø> (ø)
plugins-cookie-parser 26.35% <ø> (ø)
plugins-crypto 26.21% <ø> (ø)
plugins-dd-trace-api 35.39% <100.00%> (-0.10%) ⬇️
plugins-express-mongo-sanitize 26.50% <ø> (ø)
plugins-express-session 26.31% <ø> (ø)
plugins-fastify 39.43% <100.00%> (-0.09%) ⬇️
plugins-fetch 35.69% <100.00%> (-0.09%) ⬇️
plugins-fs 35.63% <100.00%> (-0.10%) ⬇️
plugins-generic-pool 25.57% <ø> (ø)
plugins-google-cloud-pubsub 43.02% <100.00%> (-0.08%) ⬇️
plugins-grpc 38.04% <100.00%> (-0.09%) ⬇️
plugins-handlebars 26.54% <ø> (ø)
plugins-hapi 37.23% <100.00%> (-0.09%) ⬇️
plugins-hono 37.52% <100.00%> (-0.09%) ⬇️
plugins-ioredis 35.60% <100.00%> (-0.09%) ⬇️
plugins-knex 26.20% <ø> (ø)
plugins-langgraph 35.08% <100.00%> (-0.09%) ⬇️
plugins-ldapjs 24.12% <ø> (ø)
plugins-light-my-request 25.93% <ø> (ø)
plugins-limitd-client 30.16% <100.00%> (-0.10%) ⬇️
plugins-lodash 25.66% <ø> (ø)
plugins-mariadb 36.54% <100.00%> (-0.05%) ⬇️
plugins-memcached 35.26% <100.00%> (-0.09%) ⬇️
plugins-microgateway-core 36.36% <100.00%> (-0.09%) ⬇️
plugins-moleculer 38.03% <100.00%> (-0.09%) ⬇️
plugins-mongodb 36.37% <100.00%> (-0.09%) ⬇️
plugins-mongodb-core 36.07% <100.00%> (-0.12%) ⬇️
plugins-mongoose 36.13% <100.00%> (ø)
plugins-multer 26.31% <ø> (ø)
plugins-mysql 36.34% <100.00%> (-0.09%) ⬇️
plugins-mysql2 36.34% <100.00%> (-0.09%) ⬇️
plugins-node-serialize 26.60% <ø> (ø)
plugins-opensearch 34.93% <100.00%> (-0.09%) ⬇️
plugins-passport-http 26.37% <ø> (ø)
plugins-postgres 34.32% <100.00%> (-0.11%) ⬇️
plugins-process 26.21% <ø> (ø)
plugins-pug 26.56% <ø> (ø)
plugins-redis 35.91% <100.00%> (-0.09%) ⬇️
plugins-router 40.00% <100.00%> (-0.09%) ⬇️
plugins-sequelize 25.19% <ø> (ø)
plugins-test-and-upstream-amqp10 35.62% <100.00%> (-0.09%) ⬇️
plugins-test-and-upstream-amqplib 40.82% <100.00%> (-0.09%) ⬇️
plugins-test-and-upstream-apollo 36.53% <50.00%> (-0.08%) ⬇️
plugins-test-and-upstream-avsc 35.63% <100.00%> (-0.09%) ⬇️
plugins-test-and-upstream-bunyan 31.27% <100.00%> (-0.10%) ⬇️
plugins-test-and-upstream-connect 37.84% <100.00%> (-0.09%) ⬇️
plugins-test-and-upstream-graphql 37.17% <100.00%> (-0.09%) ⬇️
plugins-test-and-upstream-koa 37.49% <100.00%> (-0.09%) ⬇️
plugins-test-and-upstream-protobufjs 35.84% <100.00%> (-0.09%) ⬇️
plugins-test-and-upstream-rhea 40.90% <100.00%> (-0.12%) ⬇️
plugins-undici 36.59% <100.00%> (-0.09%) ⬇️
plugins-url 26.21% <ø> (ø)
plugins-valkey 35.28% <100.00%> (-0.09%) ⬇️
plugins-vm 26.21% <ø> (ø)
plugins-winston 31.72% <100.00%> (+0.04%) ⬆️
plugins-ws 38.93% <100.00%> (-0.09%) ⬇️
profiling-macos 38.06% <100.00%> (-0.09%) ⬇️
profiling-ubuntu 38.22% <100.00%> (-0.09%) ⬇️
profiling-windows 39.53% <100.00%> (-0.09%) ⬇️
serverless-azure-functions-client 25.26% <ø> (ø)
serverless-azure-functions-eventhubs 25.26% <ø> (ø)
serverless-azure-functions-servicebus 25.26% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@datadog-prod-us1-6
Copy link
Copy Markdown

datadog-prod-us1-6 Bot commented Apr 9, 2026

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 68.28% (-0.01%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: cf3221f | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!

@pr-commenter
Copy link
Copy Markdown

pr-commenter Bot commented Apr 9, 2026

Benchmarks

Benchmark execution time: 2026-04-09 14:40:40

Comparing candidate commit cf3221f in PR branch BridgeAR/2026-04-09-fix-graphql-security-issue with baseline commit 9ed88dc in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 227 metrics, 33 unstable metrics.

@BridgeAR BridgeAR marked this pull request as ready for review April 9, 2026 16:48
@BridgeAR BridgeAR requested a review from a team as a code owner April 9, 2026 16:48
@BridgeAR BridgeAR merged commit 6b04b98 into master Apr 9, 2026
834 of 1100 checks passed
@BridgeAR BridgeAR deleted the BridgeAR/2026-04-09-fix-graphql-security-issue branch April 9, 2026 16:58
dd-octo-sts Bot pushed a commit that referenced this pull request Apr 10, 2026
This was brought up by @zbrydon who also suggested a fix.
This includes that fix and it adds additional safeguards.

Closes: #7902

Co-authored-by: Zac Brydon @zbrydon
@dd-octo-sts dd-octo-sts Bot mentioned this pull request Apr 10, 2026
juan-fernandez pushed a commit that referenced this pull request Apr 10, 2026
This was brought up by @zbrydon who also suggested a fix.
This includes that fix and it adds additional safeguards.

Closes: #7902

Co-authored-by: Zac Brydon @zbrydon
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants