Skip to content

Use Object.create(null) over {} to avoid prototype issues#4634

Open
benjie wants to merge 1 commit into17.x.xfrom
obj-create-null-17
Open

Use Object.create(null) over {} to avoid prototype issues#4634
benjie wants to merge 1 commit into17.x.xfrom
obj-create-null-17

Conversation

@benjie
Copy link
Member

@benjie benjie commented Mar 24, 2026

Forward-port of #4631

@vercel
Copy link

vercel bot commented Mar 24, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
graphql-js Ignored Ignored Mar 24, 2026 3:55pm

Request Review

@benjie benjie requested a review from yaacovCR March 24, 2026 16:01
);
}
return coercedValues;
return { ...coercedValues };
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this strictly necessary?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Without it, it's a breaking change (assuming this is reachable from user code) since you'd be returning a null prototype object rather than a prototypeful object. Users who did console.log(`Blah blah ${obj} blah blah`) would have their code change from logging Blah blah [object Object] blah blah to throwing an error.

> const a = {}
undefined
> const b = Object.create(null)
undefined
> String(a)
'[object Object]'
> String(b)
Uncaught TypeError: Cannot convert object to primitive value
    at String (<anonymous>)

The reason I didn't merge this myself is because ideally we'd just switch to null prototype objects and get rid of the problem entirely. But I didn't want to introduce a breaking change, hence including this careful back-compat.

Personally I vote to remove this.

}

return coercedValue;
return { ...coercedValue };
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants