search

graphql / graphql-playground

🎮 GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration)
MIT License
8.77k stars 735 forks source link

!!! Page is completely broken when a specific verison is requested, because of security fix !!! #1268

Closed jedwards1211 closed 4 years ago

jedwards1211 commented 4 years ago

Raising awareness of #1254 because it seems like no maintainers have experienced it.

Please try adding version to your middleware options, like in the following, and then try opening GraphQL Playground:

      app.use('/graphql', expressPlayground({
        version: '1.7.28',
        endpoint: ...,
      }))

You'll get a blank page, because with this option it builds a bad CDN URL:

//cdn.jsdelivr.net/npm/graphql-playground-react/@1.7.28/build/static/js/middleware.js
                                               ^ this / shouldn't be here!

You're not seeing it because the URL is good when no version is requested:

//cdn.jsdelivr.net/npm/graphql-playground-react/build/static/js/middleware.js

This issue pertains to the following package(s):

What OS and OS version are you experiencing the issue(s) on?

any

What version of graphql-playground(-electron/-middleware) are you experiencing the issue(s) on?

any that incorporates the recent security fix

What is the expected behavior?

GraphQL playground page works

What is the actual behavior?

Get a blank, unresponsive page, with errors in the console

What steps may we take to reproduce the behavior?

Request a specific version in your middleware options

Please provide a gif or image of the issue for a quicker response/fix.

jedwards1211 commented 4 years ago

fixed by #1238