[Data masking] Fix bug where masked field could be returned in parent…

… query (#12014)

.size-limits.json

@@ -1,4 +1,4 @@
 {
-  "dist/apollo-client.min.cjs": 40818,
-  "import { ApolloClient, InMemoryCache, HttpLink } from \"dist/index.js\" (production)": 33647
+  "dist/apollo-client.min.cjs": 40870,
+  "import { ApolloClient, InMemoryCache, HttpLink } from \"dist/index.js\" (production)": 33688
 }

src/core/__tests__/masking.test.ts

@@ -144,6 +144,44 @@ describe("maskOperation", () => {
     });
   });
 
+  test("masks fragments from nested objects when query gets fields from same object", () => {
+    const query = gql`
+      query {
+        user {
+          profile {
+            __typename
+            id
+          }
+          ...UserFields
+        }
+      }
+      fragment UserFields on User {
+        profile {
+          id
+          fullName
+        }
+      }
+    `;
+
+    const data = maskOperation(
+      deepFreeze({
+        user: {
+          __typename: "User",
+          profile: { __typename: "Profile", id: "1", fullName: "Test User" },
+        },
+      }),
+      query,
+      createFragmentMatcher(new InMemoryCache())
+    );
+
+    expect(data).toEqual({
+      user: {
+        __typename: "User",
+        profile: { __typename: "Profile", id: "1" },
+      },
+    });
+  });
+
   test("deep freezes the masked result if the original data is frozen", () => {
     const query = gql`
       query {

src/core/masking.ts

@@ -156,7 +156,13 @@ function maskSelectionSet(
               __DEV__ ? `${path || ""}.${keyName}` : void 0
             );
 
-            if (childChanged) {
+            if (
+              childChanged ||
+              // This check prevents cases where masked fields may accidentally be
+              // returned as part of this object when the fragment also selects
+              // additional fields from the same child selection.
+              Object.keys(masked).length !== Object.keys(data[keyName]).length
+            ) {
               memo[keyName] = masked;
               changed = true;
             }