graphql-python / graphql-python/graphql-core

Validation/coercion of input variables violates the GraphQL spec

Aperta
#223 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Python
Stelle
531
Fork
146
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

When callling graphql-core's `execute()` function with `variable_values` which do not pass validation -- for example, including an unexpected key in the `variable_values` dictionary -- the current behavior is that an `ExecutionResult` object is returned from the function, with the associated GraphQLError present inside it. Instead, this should be treated as a Request error, according to the spec, meaning that a `GraphQLError` should be raised from `execute()`.

The GraphQL spec states:

> [Request errors](https://spec.graphql.org/October2021/#sec-Errors.Request-errors)
Request errors are raised before execution begins. This may occur due to a parse grammar or validation error in the requested document, an inability to determine which operation to execute, or **invalid input values for variables**.

This means that it is incorrect for the `coerce_variable_values` function to be returning a GraphQLError inside an ExecutionResult: https://github.com/graphql-python/graphql-core/blob/9dcf25e66f6ed36b77de788621cf50bab600d1d3/src/graphql/execution/values.py#L93-L99

doing so means that a response payload is returned containing both an "errors" key and a null "data" key. Again, this a violation of the spec:

> If a request error is raised, execution does not begin and the **data entry in the response must not be present**. The errors entry must include the error.

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.