fix(handler): JSON body must be an object

Author: enisdenjo

src/handler.ts

@@ -434,6 +434,9 @@ export function createHandler<RawRequest = unknown, Context = unknown>(
           } catch (err) {
             throw new Error('Unparsable JSON body');
           }
+          if (!isObject(data)) {
+            throw new Error('JSON body must be an object');
+          }
           partParams.operationName = data.operationName;
           partParams.query = data.query;
           partParams.variables = data.variables;

src/utils.ts

@@ -7,7 +7,11 @@
 import type { ExecutionResult, GraphQLError } from 'graphql';
 
 /** @private */
-export function isObject(val: unknown): val is Record<PropertyKey, unknown> {
+export function isObject(val: unknown): val is Record<
+  PropertyKey,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  any
+> {
   return typeof val === 'object' && val !== null;
 }