Skip to content

Commit 67778a8

Browse files
enisdenjogithub-actions[bot]
enisdenjo
and
github-actions[bot]
authored
fix(audits/server): Check the actual content encoding instead of the indication (#41)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent bcd3161 commit 67778a8

File tree

16 files changed

+144
-276
lines changed

16 files changed

+144
-276
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -747,10 +747,12 @@ If you want a feature-full server with bleeding edge technologies, you're recomm
747747
| Name | Audit |
748748
| ------------------------------------------------------------------ | -------------------------------------------------------- |
749749
| [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server) | [✅ Compliant](/implementations/graphql-yoga/README.md) |
750+
| [graphql-helix](https://www.graphql-helix.com/) | [✅ Compliant](/implementations/graphql-helix/README.md) |
750751
| [hotchocolate](https://chillicream.com/docs/hotchocolate) | [✅ Compliant](/implementations/hotchocolate/README.md) |
751752
| [pioneer](https://pioneer.dexclaimation.com/) | [✅ Compliant](/implementations/pioneer/README.md) |
752753
| [postgraphile](https://www.graphile.org/postgraphile/) | [✅ Compliant](/implementations/postgraphile/README.md) |
753754
| [apollo-server](https://www.apollographql.com/docs/apollo-server/) | [✅ Compliant](/implementations/apollo-server/README.md) |
755+
| [deno](https://deno.com/blog/build-a-graphql-server-with-deno) | [✅ Compliant](/implementations/deno/README.md) |
754756

755757
## [Documentation](docs/)
756758

‎implementations/apollo-server/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ _* This report was auto-generated by graphql-http_
1111
2. MUST accept application/json and match the content-type
1212
3. SHOULD accept \*/\* and use application/json for the content-type
1313
4. MUST use utf-8 encoding when responding
14-
5. MUST accept utf-8 encoding
15-
6. MUST assume utf-8 if encoding is unspecified
14+
5. MUST accept utf-8 encoded request
15+
6. MUST assume utf-8 in request if encoding is unspecified
1616
7. MUST accept POST requests
1717
8. MAY NOT allow executing mutations on GET requests
1818
9. SHOULD respond with 4xx status code if content-type is not supplied on POST requests

‎implementations/deno/README.md‎

Lines changed: 33 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -3,43 +3,45 @@ _* This report was auto-generated by graphql-http_
33
# GraphQL over HTTP audit report
44

55
- **79** audits in total
6-
- ✅ **32** pass
6+
- ✅ **35** pass
77
- ⚠️ **44** warnings (optional)
8-
- ❌ **3** errors (required)
98

109
## Passing
1110
1. MUST accept application/json and match the content-type
1211
2. SHOULD accept \*/\* and use application/json for the content-type
1312
3. SHOULD assume application/json content-type when accept is missing
14-
4. MUST accept POST requests
15-
5. MAY accept application/x-www-form-urlencoded formatted GET requests
16-
6. MAY NOT allow executing mutations on GET requests
17-
7. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
18-
8. MUST accept application/json POST requests
19-
9. MUST require a request body on POST
20-
10. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
21-
11. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
22-
12. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
23-
13. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
24-
14. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
25-
15. MUST allow string {query} parameter when accepting application/json
26-
16. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
27-
17. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
28-
18. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
29-
19. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
30-
20. MUST allow string {operationName} parameter when accepting application/json
31-
21. MUST allow null {variables} parameter when accepting application/json
32-
22. MUST allow null {operationName} parameter when accepting application/json
33-
23. MUST allow null {extensions} parameter when accepting application/json
34-
24. MUST allow map {variables} parameter when accepting application/json
35-
25. MUST allow map {extensions} parameter when accepting application/json
36-
26. SHOULD use 200 status code if parameters are invalid when accepting application/json
37-
27. SHOULD use 200 status code on document parsing failure when accepting application/json
38-
28. SHOULD use 200 status code on document validation failure when accepting application/json
39-
29. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
40-
30. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
41-
31. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
42-
32. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
13+
4. MUST use utf-8 encoding when responding
14+
5. MUST accept utf-8 encoded request
15+
6. MUST assume utf-8 in request if encoding is unspecified
16+
7. MUST accept POST requests
17+
8. MAY accept application/x-www-form-urlencoded formatted GET requests
18+
9. MAY NOT allow executing mutations on GET requests
19+
10. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
20+
11. MUST accept application/json POST requests
21+
12. MUST require a request body on POST
22+
13. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json
23+
14. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json
24+
15. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json
25+
16. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json
26+
17. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json
27+
18. MUST allow string {query} parameter when accepting application/json
28+
19. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json
29+
20. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json
30+
21. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json
31+
22. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json
32+
23. MUST allow string {operationName} parameter when accepting application/json
33+
24. MUST allow null {variables} parameter when accepting application/json
34+
25. MUST allow null {operationName} parameter when accepting application/json
35+
26. MUST allow null {extensions} parameter when accepting application/json
36+
27. MUST allow map {variables} parameter when accepting application/json
37+
28. MUST allow map {extensions} parameter when accepting application/json
38+
29. SHOULD use 200 status code if parameters are invalid when accepting application/json
39+
30. SHOULD use 200 status code on document parsing failure when accepting application/json
40+
31. SHOULD use 200 status code on document validation failure when accepting application/json
41+
32. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
42+
33. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
43+
34. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
44+
35. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
4345

4446
## Warnings
4547
The server _SHOULD_ support these, but is not required.
@@ -935,77 +937,3 @@ The server _SHOULD_ support these, but is not required.
935937
</details>
936938

937939

938-
## Errors
939-
The server _MUST_ support these.
940-
941-
1. MUST use utf-8 encoding when responding<br />
942-
943-
<details>
944-
<summary>Response body is not UTF-8 encoded</summary>
945-
946-
```json
947-
{
948-
"statusText": "OK",
949-
"status": 200,
950-
"headers": {
951-
"vary": "Accept-Encoding",
952-
"date": "<timestamp>",
953-
"content-type": "application/json",
954-
"content-length": "59",
955-
"content-encoding": "gzip"
956-
},
957-
"body": null
958-
}
959-
```
960-
</details>
961-
962-
2. MUST accept utf-8 encoding<br />
963-
964-
<details>
965-
<summary>Response header content-type does not contain utf-8</summary>
966-
967-
```json
968-
{
969-
"statusText": "OK",
970-
"status": 200,
971-
"headers": {
972-
"vary": "Accept-Encoding",
973-
"date": "<timestamp>",
974-
"content-type": "application/json",
975-
"content-length": "59",
976-
"content-encoding": "gzip"
977-
},
978-
"body": {
979-
"data": {
980-
"__typename": "Query"
981-
}
982-
}
983-
}
984-
```
985-
</details>
986-
987-
3. MUST assume utf-8 if encoding is unspecified<br />
988-
989-
<details>
990-
<summary>Response header content-type does not contain utf-8</summary>
991-
992-
```json
993-
{
994-
"statusText": "OK",
995-
"status": 200,
996-
"headers": {
997-
"vary": "Accept-Encoding",
998-
"date": "<timestamp>",
999-
"content-type": "application/json",
1000-
"content-length": "59",
1001-
"content-encoding": "gzip"
1002-
},
1003-
"body": {
1004-
"data": {
1005-
"__typename": "Query"
1006-
}
1007-
}
1008-
}
1009-
```
1010-
</details>
1011-

‎implementations/deno/report.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"total": 79,
3-
"ok": 32,
3+
"ok": 35,
44
"warn": 44,
5-
"error": 3
5+
"error": 0
66
}

‎implementations/express-graphql/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ _* This report was auto-generated by graphql-http_
1111
2. SHOULD accept \*/\* and use application/json for the content-type
1212
3. SHOULD assume application/json content-type when accept is missing
1313
4. MUST use utf-8 encoding when responding
14-
5. MUST accept utf-8 encoding
15-
6. MUST assume utf-8 if encoding is unspecified
14+
5. MUST accept utf-8 encoded request
15+
6. MUST assume utf-8 in request if encoding is unspecified
1616
7. MUST accept POST requests
1717
8. MAY accept application/x-www-form-urlencoded formatted GET requests
1818
9. MAY NOT allow executing mutations on GET requests

‎implementations/graph-client/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ _* This report was auto-generated by graphql-http_
1111
3. SHOULD accept \*/\* and use application/json for the content-type
1212
4. SHOULD assume application/json content-type when accept is missing
1313
5. MUST use utf-8 encoding when responding
14-
6. MUST accept utf-8 encoding
15-
7. MUST assume utf-8 if encoding is unspecified
14+
6. MUST accept utf-8 encoded request
15+
7. MUST assume utf-8 in request if encoding is unspecified
1616
8. MUST accept POST requests
1717
9. MAY accept application/x-www-form-urlencoded formatted GET requests
1818
10. MAY NOT allow executing mutations on GET requests

0 commit comments

Comments
 (0)