Proposal: case-insensitive APQ hash validation
- 主要语言
- Go
- 星标
- 10.8k
- 派生
- 1.3k
- 平均合并
- 2 天 36 分钟
- 30 天内合并 PR
- 26
描述
### What happened?
The server returns an error `provided APQ hash does not match query` even when the queries in question are equal.
This happens because of this line:
https://github.com/99designs/gqlgen/blob/cc177859d901ab166fc2c5d741ace906e91fb225/graphql/handler/extension/apq.go#L85
Here, the internal hash, calculated in `computeQueryHash` is compared with the received hash from the client in `extension.Sha256`.
Here's the problem:
`computeQueryHash` uses `hex.EncodeToString` which always returns **lowercase** hex characters.
**The hash from the client might not be lowercase though.**
In my case, I use the C# client (https://github.com/graphql-dotnet/graphql-client#automatic-persisted-queries-apq) which always returns **uppercase** hashes.
The above-mentioned line in `apq.go` performs a simple string comparison and since `123abc != 123ABC`, it returns an error even if these two hashes are idempotent.
### What did you expect?
Hashes to be compared case-insensitively, e.g. by using [`strings.EqualFold`](https://pkg.go.dev/strings#EqualFold).
I have a fork with this fix ready if feedback on this suggestion is positive (I created this issue first instead of directly raising a PR according to the [contribution guidelines](https://github.com/99designs/gqlgen/blob/master/CONTRIBUTING.md)).
### Minimal graphql.schema and models to reproduce
n/a
### versions
- `gqlgen@v0.17.53`
- `go 1.23.0`
贡献指南
调研方向
问题位于 graphql/handler/extension/apq.go 第 85 行的 APQ 哈希比较处。修复方法是将字符串相等性检查替换为 strings.EqualFold,以不区分大小写地比较哈希。首先阅读 APQ 扩展代码以了解流程,然后修改比较逻辑,并运行现有的 APQ 相关测试,以验证更改能够正确运行。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- go
- 领域
- backend-api-design
- Issue 类型
- 缺陷
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 活跃度
- 停滞
- 描述清晰度
- 描述清楚
- 新手友好度
- 70/100