Closed cbatista8a closed 6 months ago
Interesting. Firstly, why would you be executing code like that in an Entity
directory? I agree that this shouldn't be happening in GraphQLite. But that also looks like some codesmell.
Happy to accept a PR that addresses this issue.
Interesting. Firstly, why would you be executing code like that in an
Entity
directory? I agree that this shouldn't be happening in GraphQLite:
In reality, this code is just a complementary security measure that some applications still use and that prevents accessing the directory directly without going through the router even if the path is known. My vision about what I mentioned about indicating an interface for entities and controllers is that it allows classes from different frameworks to be integrated without distinction and avoids dealing with other classes that could be dirtying the architecture or the ideal folder structure.
@cbatista8a understood. I'm not entirely sure how an implementation here would look. Performance is a consideration, of course. And I'm not sure how the PHP interpreter is going to handle loading the files and the referenced code. Reflection isn't going to be sufficient for performance reasons AFAIK.
As for security, I get where you're coming from here. Obviously your webserver shouldn't be exposing this path and that should be entirely sufficient. Nonetheless, I understand the purpose. As stated, if you can find a reasonable means of implementation, a PR is welcome.
Hello, I have found a bug that can waste a lot of time discovering it.
Explain bug
When you indicate the namespace for Entities and Controllers, and in these folders you have files that are not Entities or Controllers but a simple index.php with the following code for security reasons; If you make queries, the application does not work and no errors or messages related to this behavior are displayed:
Steps to reproduce
SyntaxError: Unexpected token '<', "<!-- begin"... is not valid JSON
message on your browser extension client (ChromeiQl in this case)Expected Behavior
During schema validation, an error should be thrown indicating that the file is not a valid class. Or you could simply ignore this file if the entities and controllers inherit or implement a specific interface with which it could be evaluated, if it is a valid class for the schema, or if it should be ignored otherwise. Perhaps this approach can also improve performance if we have entities that have not yet been completed and are ignored until we indicate that they extend or implement an EntityClass or EntityInterface.