tailcallhq / tailcall

High Performance GraphQL Runtime
https://tailcall.run
Apache License 2.0
1.3k stars 254 forks source link

fix(2999): add error validation to prevent objects in query params #3137

Closed melmathari closed 3 days ago

melmathari commented 4 days ago

Prevent Objects in Query Parameters

Problem

Previously, the system allowed objects to be used in HTTP query parameters through the @http directive, which could lead to unexpected behavior since query parameters should only contain scalar values.

Solution

Added validation to ensure that query parameters only accept scalar values and not objects. The validation:

Changes

  1. Added validate_query_params() method to the Http directive to check query parameter types
  2. Added unit tests to verify validation logic
  3. Added integration tests to verify end-to-end behavior

Example

graphql ❌ This will now fail validation

query {
findEmployees(criteria: { maritalStatus: MARRIED }) @http(
query: [{ key: "nested", value: "{{.args.criteria}}" }]
)
}
✅ This will work (using scalar)

query {
findEmployeesByStatus(status: MARRIED) @http(
query: [{ key: "status", value: "{{.args.status}}" }]
)
}

Testing

Error Message

When an object is used in a query parameter, users will receive a clear error:

/claim #2999

melmathari commented 3 days ago

@tusharmath Could you please review this pull request when you have a moment? Thank you for your contributions!

tusharmath commented 3 days ago

Hey @nocodeventure-nl! Thank you for your contribution to Tailcall 🙏

Unfortunately, we cannot merge this PR as the changes proposed do not align with the requirements in the linked issue. I encourage you to review #2999 once again and open a new PR with the required changes.

Thank you for your understanding 🙌