graphql / graphql/graphql-js

GraphQLSchema does not completely validate names

Open
#4,362 21 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
20.3k
Forks
2.1k
Avg merge
44m
Merged PRs (30d)
6

Description

The `validateName` function that is used to validate lots of schema parts is currently only checking that names are not reserved:
https://github.com/graphql/graphql-js/blob/6b253e7159a6a6c64c05bcc6bb863fef5a42eeb7/src/type/validate.ts#L206-L217
It should also check that the `name` complies with https://spec.graphql.org/October2021/#Name, e.g. by testing against the regex `/^(?!__)[A-Za-z_][A-Za-z0-9_]*$/`.
~Otherwise it's possible to construct schemas (via the constructor, not by parsing) that upon printing would lead to invalid syntax, or fields which could never be queried.~ (Not the case, see below)

Contributor guide

Open the contributing guide

Research direction

Start in src/type/validate.ts at the validateName function linked in the issue, then compare its current checks with the GraphQL October 2021 Name specification. Verify that schema names violating the specified syntax are rejected, including names beginning with __, and add or update focused validation coverage if the surrounding code indicates where it belongs.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, typescript
Domain
api
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.