Use Object.create(null) over {} to avoid prototype issues

Author: benjie

src/execution/values.ts

@@ -206,7 +206,7 @@ export function getArgumentValues(
   fragmentVariableValues?: Maybe<FragmentVariableValues>,
   hideSuggestions?: Maybe<boolean>,
 ): { [argument: string]: unknown } {
-  const coercedValues: { [argument: string]: unknown } = {};
+  const coercedValues: { [argument: string]: unknown } = Object.create(null);
 
   const argumentNodes = node.arguments ?? [];
   const argNodeMap = new Map(argumentNodes.map((arg) => [arg.name.value, arg]));
@@ -224,7 +224,7 @@ export function getArgumentValues(
       hideSuggestions,
     );
   }
-  return coercedValues;
+  return { ...coercedValues };
 }
 
 // eslint-disable-next-line max-params

src/utilities/coerceInputValue.ts

@@ -69,7 +69,7 @@ export function coerceInputValue(
       return; // Invalid: intentionally return no value.
     }
 
-    const coercedValue: any = {};
+    const coercedValue: any = Object.create(null);
     const fieldDefs = type.getFields();
     const hasUndefinedField = Object.keys(inputValue).some(
       (name) => !Object.hasOwn(fieldDefs, name),
@@ -109,7 +109,7 @@ export function coerceInputValue(
       }
     }
 
-    return coercedValue;
+    return { ...coercedValue };
   }
 
   const leafType = assertLeafType(type);