search

graphql-elixir / graphql-phoenix-rethinkdb

Example integration of RethinkDB and GraphQL Elixir
http://graphql-elixir.org
21 stars 2 forks source link

to_atom #1

Open note89 opened 8 years ago

note89 commented 8 years ago

in database.ex for {key, val} <- doc, into: %{}, do: {String.to_atom(key), val}

https://elixir-lang.slack.com/team/hamiltop explained that this was not a very good idea in elixir and could lead to a malicious attacker crashing ones servers. instead to_existing_atom should be used

AdamBrodzinski commented 8 years ago

@note89 I agree but in this case wouldn't it be possible that those keys were never defined beforehand, making it crash because they're not existing yet? (example being that the DB data doesn't match the schema exactly) Or perhaps they would from the schema definition?

I think the bigger issue is that it's needed in the first place to go from String -> Symbol -> String for the response.