Comments (6)
Thanks Teddy, I’ll look into it
from graphql.js.
This is very interesting, thanks again for raising the issue! I haven’t worked with tagged templates yet, I’ll see how the escaping / replacement with variables could work. If I understand correctly we want
- Prevent template literals outside of parameters by escaping them
- Replace template literals used in parameters with variables
I like the graphql(query, options)
api as it works similar to request(route, options)
, I’d like to keep that. But I could imagine to expose a graphql.query
function which could be a template tag function and only allow the result of that to be passed as a query in the request.
Such a GraphQL query parsing function sounds like a good utility that would be useful in general, are you aware if it already exists? If not it would be cool to build it independent of octokit I think, wanna collaborate on that? I know https://www.npmjs.com/package/graphql-tag but we don’t want to work with ASTs
from graphql.js.
Does that look good?
example 1
const repoId = 123
const result = query`
mutation {
addStar(input: {clientMutationId: "x", starrableId: "${repoId}"}) {
clientMutationId
}
}
`
result
would now be
{
query: 'mutation {\n addStar(input: {clientMutationId: "x", starrableId: "$starrableId"}) {\n clientMutationId\n }\n }',
variables: {
starrableId: 123
}
}
example 2
const fields = ['login', 'bio']
const result = query`
{
viewer {
${fields.join('\n')}
}
}
`
Throws an error
Error: literals not allowed outside of parameters
from graphql.js.
people might still want to construct dynamic queries, we could provide some workaround that makes clear that what they do has the danger of query injections
from graphql.js.
Sounds good to me.
from graphql.js.
I've added a note to the README referencing this issue. I have decided not going to change the API. Thanks for making me aware of the potential injection attack and for bearing with me :)
from graphql.js.
Related Issues (20)
- Deployment branch rules in environments cause error
- variables aren't working HOT 2
- Requests for Projects (Beta) via graphql return wrong results HOT 2
- I don't think it's necessary. If you really need a defaults callback then you can use https://github.com/octokit/core.js which does support it. HOT 1
- GitHub GraphQL cursor Pagination on first request HOT 1
- How to populate Int Variables in Typescript HOT 2
- Remove Node version 10 from .github/workflows/test.yml
- ci: use `test_matrix` and `test` jobs HOT 1
- How to add connection timeout constraint HOT 3
- "An operation name is required if the query contains multiple operations" HOT 2
- Accidental release of `octokit-next.js` to `@octokit/graphql` HOT 6
- Accidental release of `octokit-next.js` to `@octokit/graphql` HOT 1
- Possibility to use custom reviver in deserialization? HOT 2
- Cannot fetch more than 100 branches, even when using pagination
- [BUG]: Uncaught TypeError: Cannot read properties of undefined (reading 'map') - HOT 3
- How can I retrieve the date an issue was added to a projectV2 using Github's GRAPHQL api? HOT 3
- [FEAT]: Return type for TS HOT 5
- [FEAT]: GraphQL: Ensure Order of [Processing of] Mutations HOT 3
- [BUG]: getting unicorn HTML in an error response HOT 5
- [FEAT]: Custom Properties (Queryable & Mutation to set/update). HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from graphql.js.