From 35cf186ed9237e41735f150e0cbf4edd995ab0d9 Mon Sep 17 00:00:00 2001
From: Lenz Weber-Tronic <lorenz.weber-tronic@apollographql.com>
Date: Thu, 5 Sep 2024 10:30:41 +0200
Subject: [PATCH] Create `normalizedHeaders` as object with `Object` prototype.
 (#12054)

Co-authored-by: phryneas <phryneas@users.noreply.github.com>
---
 .changeset/polite-toys-battle.md          | 5 +++++
 .size-limits.json                         | 4 ++--
 src/link/http/selectHttpOptionsAndBody.ts | 7 ++++---
 3 files changed, 11 insertions(+), 5 deletions(-)
 create mode 100644 .changeset/polite-toys-battle.md

diff --git a/.changeset/polite-toys-battle.md b/.changeset/polite-toys-battle.md
new file mode 100644
index 00000000000..90082489d0d
--- /dev/null
+++ b/.changeset/polite-toys-battle.md
@@ -0,0 +1,5 @@
+---
+"@apollo/client": patch
+---
+
+Fixed a bug where incorrect object access in some Safari extensions could cause a crash.
diff --git a/.size-limits.json b/.size-limits.json
index 01bb281164e..4777b873e7d 100644
--- a/.size-limits.json
+++ b/.size-limits.json
@@ -1,4 +1,4 @@
 {
-  "dist/apollo-client.min.cjs": 40252,
-  "import { ApolloClient, InMemoryCache, HttpLink } from \"dist/index.js\" (production)": 33066
+  "dist/apollo-client.min.cjs": 40251,
+  "import { ApolloClient, InMemoryCache, HttpLink } from \"dist/index.js\" (production)": 33061
 }
diff --git a/src/link/http/selectHttpOptionsAndBody.ts b/src/link/http/selectHttpOptionsAndBody.ts
index 33ec947cb37..c2c9580bb50 100644
--- a/src/link/http/selectHttpOptionsAndBody.ts
+++ b/src/link/http/selectHttpOptionsAndBody.ts
@@ -205,7 +205,7 @@ function removeDuplicateHeaders(
 ): typeof headers {
   // If we're not preserving the case, just remove duplicates w/ normalization.
   if (!preserveHeaderCase) {
-    const normalizedHeaders = Object.create(null);
+    const normalizedHeaders: Record<string, string> = {};
     Object.keys(Object(headers)).forEach((name) => {
       normalizedHeaders[name.toLowerCase()] = headers[name];
     });
@@ -216,7 +216,8 @@ function removeDuplicateHeaders(
   // preserving the original name.
   // This allows for non-http-spec-compliant servers that expect intentionally
   // capitalized header names (See #6741).
-  const headerData = Object.create(null);
+  const headerData: Record<string, { originalName: string; value: string }> =
+    {};
   Object.keys(Object(headers)).forEach((name) => {
     headerData[name.toLowerCase()] = {
       originalName: name,
@@ -224,7 +225,7 @@ function removeDuplicateHeaders(
     };
   });
 
-  const normalizedHeaders = Object.create(null);
+  const normalizedHeaders: Record<string, string> = {};
   Object.keys(headerData).forEach((name) => {
     normalizedHeaders[headerData[name].originalName] = headerData[name].value;
   });