Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid TypeError when querystring is present, but query missing #964

Merged
merged 5 commits into from
Apr 18, 2018

Conversation

steverice
Copy link
Contributor

@steverice steverice commented Apr 13, 2018

The express-graphql reference implementation provides a check
to protect against cases where a GET request is made that does not
have a query parameter where the GraphQL query would be present.

Without this guard, graphql-js's parse will return undefined for the DocumentNode since it has no document to read. Subsequently passing this to isQueryOperation results in a TypeError, because we are providing undefined where getOperationAst expects to get a DocumentNode.

A new test file is added for runHttpQuery, as one previously did not seem to exist.

TODO:

  • Update CHANGELOG.md with your change (include reference to issue & this PR)
  • Make sure all of the significant new logic is covered by tests
  • Rebase your changes on master so that they can be merged easily
  • Make sure all tests and linter rules pass

/label bug

@apollo-cla
Copy link

@steverice: Thank you for submitting a pull request! Before we can merge it, you'll need to sign the Meteor Contributor Agreement here: https://contribute.meteor.com/

@ghost ghost added 🪲 bug labels Apr 13, 2018
The express-graphql reference implementation [provides a check]
(https://github.com/graphql/express-graphql/blob/2e27a7335875f23ae5cccc97a9d6926970fb08c3/src/index.js#L201-L208)
to protect against cases where a GET request is made that does not
have a `query` parameter where the GraphQL query would be present.

Without this guard, graphql-js's `parse` will return `undefined`
for the `DocumentNode` since it has no document to read. Subsequently
passing this to `isQueryOperation` results in a `TypeError`, because
we are providing `undefined` where `getOperationAst` [expects to get
a DocumentNode](https://github.com/graphql/graphql-js/blob/5fe39262a308df944a87cc85b225228e7556aaa4/src/utilities/getOperationAST.js#L19).

A new test file is added for `runHttpQuery`, as one previously did
not seem to exist.
@steverice steverice force-pushed the fix-querystring-with-no-query branch from 1c28750 to 7ad44d1 Compare April 13, 2018 00:22
@abernix abernix merged commit 083a1ee into apollographql:master Apr 18, 2018
@abernix
Copy link
Member

abernix commented Apr 18, 2018

Thanks, @steverice!

@abernix
Copy link
Member

abernix commented Apr 18, 2018

This should be published in 1.3.5. Please report back how it works!

@steverice
Copy link
Contributor Author

Working as expected :) Thanks for the review + merge!

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Apr 23, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants