aws / aws/aws-appsync-community
Incorrect handling of GraphQL variables when no value is supplied
- Dominant language
- HTML
- Stars
- 507
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
If a _variable_ is used for a nullable query argument, the resolver function will see an explicit `null` even if no value was provided for the variable.
For example, given this schema snippet:
```graphql
type Item {
name: String!
}
type Query {
items(after: String): [Item!]
}
```
and this query:
```graphql
query MyQuery($after: String) {
items(after: $after) {
name
}
}
```
and no variable values provided:
```
Operation: MyQuery, Variables: {}
```
...the expected behavior is that `after` is absent from the `context.arguments` object passed to the resolver function, but instead `after` is present with an explicit `null` value:
```json
{
"after": null
}
```
This makes it impossible to differentiate between _absent_ and `null` when the client is using variables.
Here is the relevant section of the GraphQL spec: https://spec.graphql.org/October2021/#sec-Coercing-Variable-Values
Contributor guide
Research direction
Start by reviewing the October 2021 GraphQL specification section on coercing variable values, then trace how the resolver function receives context.arguments for omitted variables. Reproduce the MyQuery example with an empty Variables object and verify that the nullable after argument is absent rather than explicitly null.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100