99designs / 99designs/gqlgen

Proposal: case-insensitive APQ hash validation

未关闭 适合新手
#3,298 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Go
星标
10.8k
派生
1.3k
平均合并
2 天 36 分钟
30 天内合并 PR
26

描述

### What happened?

The server returns an error `provided APQ hash does not match query` even when the queries in question are equal.

This happens because of this line:
https://github.com/99designs/gqlgen/blob/cc177859d901ab166fc2c5d741ace906e91fb225/graphql/handler/extension/apq.go#L85
Here, the internal hash, calculated in `computeQueryHash` is compared with the received hash from the client in `extension.Sha256`.

Here's the problem:
`computeQueryHash` uses `hex.EncodeToString` which always returns **lowercase** hex characters.
**The hash from the client might not be lowercase though.**

In my case, I use the C# client (https://github.com/graphql-dotnet/graphql-client#automatic-persisted-queries-apq) which always returns **uppercase** hashes.

The above-mentioned line in `apq.go` performs a simple string comparison and since `123abc != 123ABC`, it returns an error even if these two hashes are idempotent.

### What did you expect?

Hashes to be compared case-insensitively, e.g. by using [`strings.EqualFold`](https://pkg.go.dev/strings#EqualFold).

I have a fork with this fix ready if feedback on this suggestion is positive (I created this issue first instead of directly raising a PR according to the [contribution guidelines](https://github.com/99designs/gqlgen/blob/master/CONTRIBUTING.md)).

### Minimal graphql.schema and models to reproduce

n/a

### versions
- `gqlgen@v0.17.53`
- `go 1.23.0`

贡献指南

打开贡献指南

调研方向

问题位于 graphql/handler/extension/apq.go 第 85 行的 APQ 哈希比较处。修复方法是将字符串相等性检查替换为 strings.EqualFold,以不区分大小写地比较哈希。首先阅读 APQ 扩展代码以了解流程,然后修改比较逻辑,并运行现有的 APQ 相关测试,以验证更改能够正确运行。

由索引模型根据 Issue 内容生成。

评估

技术栈
go
领域
backend-api-design
Issue 类型
缺陷
难度
2/5
预计耗时
1-3 小时
活跃度
停滞
描述清晰度
描述清楚
新手友好度
70/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。