Consider using an API design that prevents injection attacks about graphql.js

[gr2m]

Thanks Teddy, I’ll look into it

[gr2m]

This is very interesting, thanks again for raising the issue! I haven’t worked with tagged templates yet, I’ll see how the escaping / replacement with variables could work. If I understand correctly we want

1. Prevent template literals outside of parameters by escaping them
2. Replace template literals used in parameters with variables

I like the graphql(query, options) api as it works similar to request(route, options), I’d like to keep that. But I could imagine to expose a graphql.query function which could be a template tag function and only allow the result of that to be passed as a query in the request.

Such a GraphQL query parsing function sounds like a good utility that would be useful in general, are you aware if it already exists? If not it would be cool to build it independent of octokit I think, wanna collaborate on that? I know https://www.npmjs.com/package/graphql-tag but we don’t want to work with ASTs

[gr2m]

Does that look good?

example 1

const repoId = 123
const result = query`
  mutation {
    addStar(input: {clientMutationId: "x", starrableId: "${repoId}"}) {
      clientMutationId
    }
  }
`

result would now be

{
  query: 'mutation {\n    addStar(input: {clientMutationId: "x", starrableId: "$starrableId"}) {\n      clientMutationId\n    }\n  }',
  variables: {
    starrableId: 123
  }
}

example 2

const fields = ['login', 'bio']
const result = query`
  {
    viewer {
      ${fields.join('\n')}
    }
  }
`

Throws an error

Error: literals not allowed outside of parameters

[gr2m]

people might still want to construct dynamic queries, we could provide some workaround that makes clear that what they do has the danger of query injections

[not-an-aardvark]

Sounds good to me.

[gr2m]

I've added a note to the README referencing this issue. I have decided not going to change the API. Thanks for making me aware of the potential injection attack and for bearing with me :)