graphql-go / graphql-go/graphql

Lexer - Possibility to pass invalid characters eg: (null byte)

Open
#595 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
10.1k
Forks
845
PR merge metrics
No merged PRs in 30d

Description

Even tho lexer check if input data do not contains some invalid characters https://github.com/graphql-go/graphql/blob/v0.7.9/language/lexer/lexer.go#L235
It is possible to use them - Just by sending them as "plain text"
For example: inputString `"ABC\u0041"` instead of being interpreted as `"ABC\u0041"` is changed to `"ABCA"`

Example code:

```golang
func TestReadString(t *testing.T) {
input := `mutation{
requestRefund(input:{
clientMutationId:"2"
nr:"6849905030\u0041"
}){
clientMutationId
}
}`

inputSource := source.Source{Body: []byte(input)}
token, _ := readToken(source.NewSource(&inputSource), 64)

if token.Value != `6849905030\u0041` {
t.Fatal("token incorrect")
}
}
```

https://github.com/graphql-go/graphql/blob/v0.7.9/language/lexer/lexer.go#L281
Probably it require this same check as here https://github.com/graphql-go/graphql/blob/v0.7.9/language/lexer/lexer.go#L235

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.