Fix valueFromAST variable own-property checks

[abishekgiri]

Summary

Fixes an issue in valueFromAST where own-property checks were not properly enforced, which could lead to incorrect handling of inherited properties.

Changes

• Updated own-property checks to ensure only direct properties are considered
• Prevent unintended prototype chain access

Testing

• Verified behavior manually with edge cases
• Existing tests pass locally

[vercel]

@abishekgiri is attempting to deploy a commit to the The GraphQL Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: abishekgiri / name: Abishek Kumar Giri (702e107)
• ✅ login: abishekgiri / name: giria660 (89efacc, c620dcf)

[abishekgiri]

Status update

• Fixed valueFromAST() to use own-property checks when deciding whether a variable was provided.
• Added regression coverage for omitted prototype-colliding names like toString across scalar, list, and input-object cases.
• Results: targeted mocha, eslint, and prettier checks passed for this change.
• tsc in this environment still reports existing external errors from ../node_modules/@types/react-dom, which are outside this PR.

[yaacovCR]

@abishekgiri this looks to me like a legitimate bug fix, although seemingly for a longstanding bug. Thanks for this contribution! Made a small suggestion above, and there is a lint/prettier issue.

[abishekgiri]

@yaacovCR Pushed a follow-up update addressing the review feedback. This keeps the own-property fix for prototype-colliding names, restores the previous behavior for variables explicitly set to undefined, and adds regression tests for those cases. Targeted mocha, eslint, and prettier checks are passing on the updated branch.

[yaacovCR]

@abishekgiri

This seems right to me. valueFromAST is deprecated in v17, but it has not been removed, and this seems like an opportunity for an additional PR to forward-port. Let me know if you have time, otherwise I will try to take care of it. In v17 we can use Object.hasOwn, but otherwise it should be pretty similar.

[abishekgiri]

@yaacovCR Thanks, that sounds good to me. I’m glad the 16.x.xfix looks right as-is. I also checked the current17.x.xbranch and the samevalueFromAST own-property issue still appears to be present there, so a small forward-port PR makes sense. I can put that together if helpful; otherwise I’m also happy for you to handle that follow-up.

[yaacovCR]

Check was apparently dropped back in #553 !

[yaacovCR]

forward-ported in #4671 => thanks @abishekgiri !!!