Ignore __proto__ fields in deepMerge

apollographql · Jun 4, 2019 · cea7397 · cea7397
1 parent 116e1b4
commit cea7397
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/apollo-gateway/src/utilities/deepMerge.ts b/packages/apollo-gateway/src/utilities/deepMerge.ts
@@ -4,7 +4,7 @@ export function deepMerge(target: any, source: any): any {
   if (source === undefined || source === null) return target;
 
   for (const key of Object.keys(source)) {
-    if (source[key] === undefined) continue;
+    if (source[key] === undefined || key === '__proto__') continue;
 
     if (target[key] && isObject(source[key])) {
       deepMerge(target[key], source[key]);