Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add an option to reject numbers followed by names #4924

Merged
merged 6 commits into from
Apr 22, 2024

Conversation

rmosolgo
Copy link
Owner

@rmosolgo rmosolgo commented Apr 18, 2024

Fixes #4871

This option is off by default now but will be on by default in GraphQL-Ruby 3.0. You can opt into the new behavior with:

# app/graphql/my_schema.rb
GraphQL.reject_numbers_followed_by_names = true 

# ... 

And you can check for invalid query strings using the helper:

transformed_query_str = GraphQL::Language.add_space_between_numbers_and_names(query_str) 
if transformed_query_str.equal?(query_str) 
  # The old string was returned, query_str is valid 
  # do nothing 
else 
   # A new, modified query string was returned 
   # Track this occurrence and/or use the transformed string
   BugTracer.report(:invalid_query_string, query_str)
   query_str = transformed_query_str
end 

TODO:

  • Improve tests and implementation of string fix method to handle exponent notation
  • Also make sure variable definitions are covered, eg query($a: Int = 5$b: Int = 6) { ... }
  • I think that variable definitions and values followed by directives are technically legal because the following character is either @ or $, not a name. I did add tests for input object literals, and they were covered by the current implementation.
  • Are there other places where client-provided values appear, where there might be a number literal? (see above)
  • Add a CI build which runs with GraphQL.reject_numbers_followed_by_names = true

@rmosolgo rmosolgo merged commit dc62848 into master Apr 22, 2024
12 checks passed
@rmosolgo rmosolgo deleted the reject-numbers-followed-by-names branch April 22, 2024 15:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Name start at end of numbers should fail to parse
1 participant