Skip to content

GraphQLPostInvocationInputParser may distort query string read from HttpServletRequest #385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jdlib opened this issue Oct 13, 2021 · 1 comment
Labels
Milestone

Comments

@jdlib
Copy link

jdlib commented Oct 13, 2021

GraphQLPostInvocationInputParser uses request.getReader().lines().collect(joining()) to read the query string from the request. This effectively removes all line breaks from the request body.
But the query might have used these line breaks as token separator, therefore the resulting query may become invalid.

Example: Given a request body of

{ 
hero {
name
weight
} }

this will result in a query string {hero {nameweight}} and fail since there is no such attribute.

I would suggest to use request.getReader().lines().collect(joining(" ")) to read the request body, therefore replacing line breaks with a space.

@jdlib jdlib added the bug label Oct 13, 2021
@oliemansm
Copy link
Member

Good catch. Apparently nobody ever encountered this since most people apply proper indentation in the GraphQL queries which causes nobody to actually run into this bug in reality. I've added a fix as proposed.

@oliemansm oliemansm added this to the 13.0.0 milestone Jan 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants