wp-graphql / wp-graphql/wp-graphql
Prevent Persisted Queries from saving if arguments are used without variables
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.8k
- Forks
- 472
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 85
Description
We should prevent persisted queries from being saved if the query uses arguments but does not define variables for the arguments.
This will prevent situations where string concatenation is used instead of variables and a plethora of queries are stored instead of a singular query with variables.
We had 1 user use string concatenation that lead to 72,000 queries being stored.
i.e.
const POST_ID = $something_dynamic_from_url_or_something;
const query = `query {
post( id: ${POST_ID} idType: DATABASE_ID) {
id
title
date
}
}`
This would create a different persisted query for every ID used because of the string interpolation.
We should prevent this query from being saved as a persisted query and a clear error message should be returned explaining why the persisted query cannot be saved.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the persisted-query save path and the validation handling for arguments and variables. Reproduce the JavaScript example with an interpolated argument, then add coverage for rejecting it with a clear error while allowing arguments backed by declared variables; done means such queries are not stored.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, php
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100