graphiti 1.2.25 → 1.2.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5f2ffef76f6dd895acddc9a4d2deb374a3d217c94d0c85fd1feb40ecac9f369
-  data.tar.gz: c6ce48631bf54161b0678ac5d16a8e25b49c8259ec1405138559814745569129
+  metadata.gz: 872977a69e5cb7a4fd2cbe93953be2dbba89868f3c41267b8a72ce22ffb5c600
+  data.tar.gz: 2d189dcaa525e2d5a1b2ffd752a53cc28e0e381cb2411d8530e750175f9de92c
 SHA512:
-  metadata.gz: 0e9d797893dfad771fbfe3400fc66e5830b80e8b029a059fdc12102c904e9d535b004fb08bb4501ce190effdda6f247b476ada10c6f0f6f4d963bcb0c971ab50
-  data.tar.gz: 5a933a0b8174449530858b06081eb09cd181d1d02f37f5befaac0e1f3dd16bf420e2e6e72d2c64a4750fd8ff2eaf3e2e333b59843c01ac613fa0c10e3e02ef0e
+  metadata.gz: 2e3b922df304f43f3404db5e0213dce76bd073d6d226a3c62620fc5ff0198c2a13a6c7ed3b48b92421cfb6396acb31c11e84edb099bdab915cc9b8917baa845b
+  data.tar.gz: 80a5f5f23638c598c64012032a7ab4aea3fc5ce515f6b72f9bdf93f19c1c50ee3fd9fd373a6ccec34e4f84f6cf3217257d10d93b4a870aa06e91be67e610c8b0

data/lib/graphiti/errors.rb

@@ -366,6 +366,20 @@ module Graphiti
       end
     end
 
+    class UndefinedIDLookup < Base
+      def initialize(resource_class)
+        @resource_class = resource_class
+      end
+
+      def message
+        <<~MSG
+          Tried to resolve #{@resource_class} with an :id filter, but the filter was nil.
+          This can result in unscoping a query, which can cause incorrect values to be
+          returned which may or may not bypass standard access controls.
+        MSG
+      end
+    end
+
     class UnknownAttribute < AttributeError
       def message
         "#{super}, but could not find an attribute with that name."

data/lib/graphiti/resource/interface.rb

@@ -23,6 +23,9 @@ module Graphiti
 
         # @api private
         def _find(params = {}, base_scope = nil)
+          guard_nil_id!(params[:data])
+          guard_nil_id!(params)
+
           id = params[:data].try(:[], :id) || params.delete(:id)
           params[:filter] ||= {}
           params[:filter][:id] = id if id
@@ -52,6 +55,13 @@ module Graphiti
             end
           end
         end
+
+        def guard_nil_id!(params)
+          return unless params
+          if params.key?(:id) && params[:id].nil?
+            raise Errors::UndefinedIDLookup.new(self)
+          end
+        end
       end
     end
   end

data/lib/graphiti/version.rb

@@ -1,3 +1,3 @@
 module Graphiti
-  VERSION = "1.2.25"
+  VERSION = "1.2.26"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: graphiti
 version: !ruby/object:Gem::Version
-  version: 1.2.25
+  version: 1.2.26
 platform: ruby
 authors:
 - Lee Richmond
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-09-02 00:00:00.000000000 Z
+date: 2020-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jsonapi-serializable