wp-graphql / wp-graphql/wp-graphql

Prevent Persisted Queries from saving if arguments are used without variables

Open
#4,313 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

effort: med impact: med plugin: smart-cache scope: extensions status: actionable type: enhancement
Dominant language
PHP
Stars
3.8k
Forks
472
Avg merge
1d 7h
Merged PRs (30d)
85

Description

We should prevent persisted queries from being saved if the query uses arguments but does not define variables for the arguments.

This will prevent situations where string concatenation is used instead of variables and a plethora of queries are stored instead of a singular query with variables.

We had 1 user use string concatenation that lead to 72,000 queries being stored.

i.e.

const POST_ID = $something_dynamic_from_url_or_something;

const query = `query { 
  post( id: ${POST_ID} idType: DATABASE_ID) { 
     id 
     title
     date 
   }
}`

This would create a different persisted query for every ID used because of the string interpolation.

We should prevent this query from being saved as a persisted query and a clear error message should be returned explaining why the persisted query cannot be saved.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the persisted-query save path and the validation handling for arguments and variables. Reproduce the JavaScript example with an interpolated argument, then add coverage for rejecting it with a clear error while allowing arguments backed by declared variables; done means such queries are not stored.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, php
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.