Move from '{}' to 'Object.create(null)' in more places (#2877)

Author: benjie

.changeset/cozy-coats-serve.md

@@ -0,0 +1,12 @@
+---
+"graphile-build-pg": patch
+"graphile-build": patch
+"graphile-utils": patch
+"postgraphile": patch
+"ruru-components": patch
+"graphile-export": patch
+"@dataplan/pg": patch
+"grafast": patch
+---
+
+Safety - use null prototype objects in more places.

grafast/bench/src/index.ts

@@ -65,7 +65,7 @@ export async function bench(
         );
         const variableValues = variableValuesMatch
           ? JSON5.parse(variableValuesMatch[1])
-          : {};
+          : Object.create(null);
         const checkForErrors = (
           result: ExecutionResult | ExecutionPatchResult,
         ) => {

grafast/grafast/src/makeGrafastSchema.ts

@@ -299,7 +299,7 @@ export function makeGrafastSchema(details: GrafastSchemaConfig): GraphQLSchema {
   } else {
     // Hackily convert the new format into the old format. We'll do away with
     // this in future, but for now it's the easiest way to ensure compatibility
-    plans = {};
+    plans = Object.create(null);
 
     const assertLocation = <
       TExpected extends
@@ -357,7 +357,7 @@ export function makeGrafastSchema(details: GrafastSchemaConfig): GraphQLSchema {
     };
     for (const [typeName, spec] of Object.entries(objects ?? {})) {
       const t = assertLocation(typeName, "objects");
-      const o = {} as Record<string, any>;
+      const o = Object.create(null) as Record<string, any>;
       plans[typeName] = o as any;
 
       const { plans: planResolvers = {}, ...rest } = spec;
@@ -374,7 +374,7 @@ export function makeGrafastSchema(details: GrafastSchemaConfig): GraphQLSchema {
 
     for (const [typeName, spec] of Object.entries(inputObjects ?? {})) {
       const t = assertLocation(typeName, "inputObjects");
-      const o = {} as Record<string, any>;
+      const o = Object.create(null) as Record<string, any>;
       plans[typeName] = o as any;
 
       const { plans: planResolvers = {}, ...rest } = spec;
@@ -393,7 +393,7 @@ export function makeGrafastSchema(details: GrafastSchemaConfig): GraphQLSchema {
 
     for (const [typeName, spec] of Object.entries(unions ?? {})) {
       assertLocation(typeName, "unions");
-      const o = {} as Record<string, any>;
+      const o = Object.create(null) as Record<string, any>;
       plans[typeName] = o as any;
 
       for (const [key, val] of Object.entries(spec)) {
@@ -403,7 +403,7 @@ export function makeGrafastSchema(details: GrafastSchemaConfig): GraphQLSchema {
 
     for (const [typeName, spec] of Object.entries(interfaces ?? {})) {
       assertLocation(typeName, "interfaces");
-      const o = {} as Record<string, any>;
+      const o = Object.create(null) as Record<string, any>;
       plans[typeName] = o as any;
 
       for (const [key, val] of Object.entries(spec)) {
@@ -418,7 +418,7 @@ export function makeGrafastSchema(details: GrafastSchemaConfig): GraphQLSchema {
 
     for (const [typeName, spec] of Object.entries(enums ?? {})) {
       const t = assertLocation(typeName, "enums");
-      const o = {} as Record<string, any>;
+      const o = Object.create(null) as Record<string, any>;
       plans[typeName] = o as any;
 
       const { values = {}, ...rest } = spec;

grafast/grafast/src/steps/object.ts

@@ -151,10 +151,13 @@ export class ObjectStep<
       this.keys,
       tuple,
     );
-    const newObj = this.keys.reduce((memo, key, i) => {
-      memo[key] = tuple[i];
-      return memo;
-    }, {} as Partial<DataFromObjectSteps<TPlans>>) as DataFromObjectSteps<TPlans>;
+    const newObj = this.keys.reduce(
+      (memo, key, i) => {
+        memo[key] = tuple[i];
+        return memo;
+      },
+      Object.create(null) as Partial<DataFromObjectSteps<TPlans>>,
+    ) as DataFromObjectSteps<TPlans>;
 
     // Cache newObj so the same tuple values result in the exact same object.
     meta.results.push([tuple, newObj]);

grafast/grafast/src/utils.ts

@@ -498,7 +498,7 @@ export function objectSpec<
           );
           return o;
         },
-        {} as GraphQLFieldConfigMap<any, Grafast.Context>,
+        Object.create(null) as GraphQLFieldConfigMap<any, Grafast.Context>,
       );
       return modifiedFields;
     },
@@ -585,7 +585,7 @@ export function objectFieldSpec<
         };
         return memo;
       }, Object.create(null))
-    : {};
+    : Object.create(null);
 
   return {
     ...spec,
@@ -640,10 +640,13 @@ function inputObjectSpec<TParent>(
     fields: () => {
       const fields =
         typeof spec.fields === "function" ? spec.fields() : spec.fields;
-      const modifiedFields = Object.keys(fields).reduce((o, key) => {
-        o[key] = inputObjectFieldSpec(fields[key], `${spec.name}.${key}`);
-        return o;
-      }, {} as GraphQLInputFieldConfigMap);
+      const modifiedFields = Object.keys(fields).reduce(
+        (o, key) => {
+          o[key] = inputObjectFieldSpec(fields[key], `${spec.name}.${key}`);
+          return o;
+        },
+        Object.create(null) as GraphQLInputFieldConfigMap,
+      );
       return modifiedFields;
     },
   };

grafast/ruru-components/src/hooks/useFetcher.ts

@@ -151,9 +151,11 @@ export const useFetcher = (
   }, [url]);
 
   const fetcherOptions = useMemo<CreateFetcherOptions>(() => {
-    const headers: Record<string, string> = explain
-      ? { "X-PostGraphile-Explain": "on", "X-GraphQL-Explain": "plan,sql" }
-      : {};
+    const headers: Record<string, string> = Object.create(null);
+    if (explain) {
+      headers["X-PostGraphile-Explain"] = "on";
+      headers["X-GraphQL-Explain"] = "plan,sql";
+    }
     return {
       url,
       headers,

graphile-build/graphile-build-pg/src/plugins/PgJWTPlugin.ts

@@ -162,16 +162,19 @@ export const PgJWTPlugin: GraphileConfig.Plugin = {
             serialize: EXPORTABLE(
               (attributeNames, pgJwtSecret, pgJwtSignOptions, signJwt) =>
                 function serialize(value: any) {
-                  const token = attributeNames.reduce((memo, attributeName) => {
-                    if (attributeName === "exp") {
-                      memo[attributeName] = value[attributeName]
-                        ? parseFloat(value[attributeName])
-                        : undefined;
-                    } else {
-                      memo[attributeName] = value[attributeName];
-                    }
-                    return memo;
-                  }, {} as any);
+                  const token = attributeNames.reduce(
+                    (memo, attributeName) => {
+                      if (attributeName === "exp") {
+                        memo[attributeName] = value[attributeName]
+                          ? parseFloat(value[attributeName])
+                          : undefined;
+                      } else {
+                        memo[attributeName] = value[attributeName];
+                      }
+                      return memo;
+                    },
+                    Object.create(null) as any,
+                  );
                   const options = Object.assign(
                     Object.create(null),
                     pgJwtSignOptions,

graphile-build/graphile-build-pg/src/plugins/PgOrderAllAttributesPlugin.ts

@@ -253,7 +253,7 @@ export const PgOrderAllAttributesPlugin: GraphileConfig.Plugin = {
               );
               return memo;
             },
-            {} as GraphQLEnumValueConfigMap,
+            Object.create(null) as GraphQLEnumValueConfigMap,
           ),
           `Adding order values from table '${pgCodec.name}'`,
         );

graphile-build/graphile-build/src/behavior.ts

@@ -189,7 +189,7 @@ export class Behavior {
           const behaviorString = key as keyof GraphileBuild.BehaviorStrings;
           if (!this.behaviorRegistry[behaviorString]) {
             this.behaviorRegistry[behaviorString] = {
-              entities: {},
+              entities: Object.create(null),
             };
           }
           const { description } = spec;

graphile-build/graphile-build/src/extend.ts

@@ -26,7 +26,7 @@ export default function extend<
   if (isDev && (Array.isArray(base) || Array.isArray(extra))) {
     throw new Error(`Do not extend arrays!`);
   }
-  const hints = base[$$hints] || {};
+  const hints = base[$$hints] || Object.create(null);
 
   const keysB = Object.keys(extra);
   const extraHints = extra[$$hints] || {};