agoo 2.14.2 → 2.14.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e538b3f1c7ed9ea23d8529c29bf5104d0882b0dcda49e6114bb011491b1e3ed7
-  data.tar.gz: ee1a1284779ec7108675794f4eff89f826c76f3a5e10a7f07a42bab8bbae31cb
+  metadata.gz: 843f3aa4a15a6ab57c7ff231930405c9ca55d3a6e33da3169a0677c420195fbe
+  data.tar.gz: 03f6b8760c6f08c0a3f9b5f75c747b77d1d4666b00af20d7db231418dfeb3c69
 SHA512:
-  metadata.gz: e28b50c1bea0934691679719532108fdd6d912f3beed8b9eabe6071ccd71af393b14f3c81d094cb82b5777a22884cc716e12d3c66629e39c5f7f1290919fc030
-  data.tar.gz: 1d478668d82b79acc3d2cabb56fe9aca55fb3513b4c5a5810c0d200a69b081573ff532a346c13d513fae0980fa6331f3701ee041d43ea7cfc32cd2d2a586d0c2
+  metadata.gz: '0684900cea98fbe812e5ae973ccd15dfaa054218340238dedfde382c535340945aea9857b98366fe52b2ff865129b299af541e940112200f2191b3b2247dfd58'
+  data.tar.gz: 95e68a0a7bc5a3eb8cd34b9853e8d89285ef9a1c78765bf970e80cdeb51f7f41f53db4948ca2885e29eef3fa7a6b738e015d01c4cbb25e41b2f50bac1fcb50a9

data/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All changes to the Agoo gem are documented here. Releases follow semantic versioning.
 
+## [2.14.3] - 2022-05-05
+
+### Fixed
+- Agoo now reports an error if the developer make the mistake of
+  building a schema that loops back on itself too many times using
+  fragments.
+
 ## [2.14.2] - 2022-02-22
 
 ### Fixed

data/ext/agoo/gqleval.c

@@ -21,6 +21,7 @@
 #include "websocket.h"
 
 #define MAX_RESOLVE_ARGS	16
+#define MAX_DEPTH		100
 
 gqlRef		gql_root = NULL;
 gqlType		_gql_root_type = NULL;
@@ -273,7 +274,10 @@ gql_eval_sels(agooErr err, gqlDoc doc, gqlRef ref, gqlField field, gqlSel sels,
     gqlSel	sel;
     gqlField	sf = NULL;
 
-    // TBD if depth over max then return an error
+    if (MAX_DEPTH < depth) {
+	return agoo_err_set(err, AGOO_ERR_EVAL, "Maximum resolve depth of %d exceeded.", MAX_DEPTH);
+    }
+    depth++;
 
     for (sel = sels; NULL != sel; sel = sel->next) {
 	if (NULL != field) {

data/ext/agoo/gqlintro.c

@@ -1497,13 +1497,13 @@ gql_intro_eval(agooErr err, gqlDoc doc, gqlSel sel, gqlValue result, int depth)
     struct _gqlCobj	obj;
 
     if (0 == strcmp("__type", sel->name)) {
-	if (1 < depth) {
+	if (2 < depth) {
 	    return agoo_err_set(err, AGOO_ERR_EVAL, "__type can only be called from a query root.");
 	}
 	obj.clas = &root_class;
 	obj.ptr = NULL;
     } else if (0 == strcmp("__schema", sel->name)) {
-	if (1 < depth) {
+	if (2 < depth) {
 	    return agoo_err_set(err, AGOO_ERR_EVAL, "__scheme can only be called from a query root.");
 	}
 	obj.clas = &root_class;

data/lib/agoo/version.rb

@@ -1,5 +1,5 @@
 
 module Agoo
   # Agoo version.
-  VERSION = '2.14.2'
+  VERSION = '2.14.3'
 end

data/test/graphql_test.rb

@@ -458,6 +458,32 @@ fragment basic on Artist {
     post_test(uri, body, 'application/graphql', expect)
   end
 
+  def test_post_fragment_loop
+    uri = URI('http://localhost:6472/graphql?indent=2')
+    body = %^
+{
+  artist(name:"Fazerdaze") {
+    ...loop
+  }
+}
+
+fragment loop on Artist {
+  name
+  ...loop
+}
+^
+    expect = %^{
+  "errors":[
+    {
+      "message":"Maximum resolve depth of 100 exceeded.",
+      "code":"eval error"
+    }
+  ]
+}
+^
+    post_test(uri, body, 'application/graphql', expect, 'errors.0.timestamp')
+  end
+
   def test_post_json_fragment
     uri = URI('http://localhost:6472/graphql?indent=2')
     body = %^{
@@ -1044,7 +1070,7 @@ mutation {
     assert_equal(expect, content)
   end
 
-  def post_test(uri, body, content_type, expect)
+  def post_test(uri, body, content_type, expect, ignore=nil)
     uri = URI(uri)
     req = Net::HTTP::Post.new(uri)
     req['Accept-Encoding'] = '*'
@@ -1055,6 +1081,11 @@ mutation {
     }
     content = res.body
     assert_equal('application/json', res['Content-Type'])
+    unless ignore.nil?
+      result = Oj.load(content, mode: :strict)
+      deep_delete(result, ignore.split('.'))
+      content = Oj.dump(result, indent: 2)
+    end
     assert_equal(expect, content)
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: agoo
 version: !ruby/object:Gem::Version
-  version: 2.14.2
+  version: 2.14.3
 platform: ruby
 authors:
 - Peter Ohler
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-02-22 00:00:00.000000000 Z
+date: 2022-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oj