graphql 2.6.3 → 2.6.10

data/lib/graphql/float_decoding_error.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+module GraphQL
+  # This error is raised when `Types::Float` is given a non-finite input value.
+  class FloatDecodingError < GraphQL::RuntimeTypeError
+    # The value which couldn't be decoded
+    attr_reader :float_value
+
+    def initialize(value)
+      @float_value = value
+      super("Float is not finite: #{value.inspect}.")
+    end
+  end
+end

data/lib/graphql/float_encoding_error.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+module GraphQL
+  # This error is raised when `Types::Float` is asked to return a non-finite value.
+  class FloatEncodingError < GraphQL::RuntimeTypeError
+    # The value which couldn't be encoded
+    attr_reader :float_value
+
+    # @return [GraphQL::Schema::Field] The field that returned a non-finite float
+    attr_reader :field
+
+    # @return [Array<String, Integer>] Where the field appeared in the GraphQL response
+    attr_reader :path
+
+    def initialize(value, context:)
+      @float_value = value
+      @field = context[:current_field]
+      @path = context[:current_path]
+      message = "Float is not finite: #{value.inspect}".dup
+      if @path
+        message << " @ #{@path.join(".")}"
+      end
+      if @field
+        message << " (#{@field.path})"
+      end
+      super("#{message}.")
+    end
+  end
+end

data/lib/graphql/language/block_string.rb

@@ -21,17 +21,12 @@ module GraphQL
             next
           end
           line_length = line.size
-          line_indent = if line.match?(/\A  [^ ]/)
-            2
-          elsif line.match?(/\A    [^ ]/)
-            4
-          elsif line.match?(/\A[^ ]/)
-            0
-          else
-            line[/\A */].size
+          leading = 0
+          while leading < line_length && line.getbyte(leading) == 32
+            leading += 1
           end
-          if line_indent < line_length && (common_indent.nil? || line_indent < common_indent)
-            common_indent = line_indent
+          if leading < line_length && (common_indent.nil? || leading < common_indent)
+            common_indent = leading
           end
         end
 
@@ -41,7 +36,7 @@ module GraphQL
             if idx == 0
               next
             else
-              line.slice!(0, common_indent)
+              line[0, common_indent] = ""
             end
           end
         end

data/lib/graphql/language/cache.rb

@@ -2,6 +2,9 @@
 
 require 'graphql/version'
 require 'digest/sha2'
+require 'openssl'
+require 'securerandom'
+require 'tempfile'
 
 module GraphQL
   module Language
@@ -9,7 +12,11 @@ module GraphQL
     #
     # With Rails, parser caching may enabled by setting `config.graphql.parser_cache = true` in your Rails application.
     #
-    # The cache may be manually built by assigning `GraphQL::Language::Parser.cache = GraphQL::Language::Cache.new("some_dir")`.
+    # The cache may be manually built by assigning `GraphQL::Language::Parser.cache = GraphQL::Language::Cache.new(Pathname.new("some_dir"), secret: ENV.fetch("GRAPHQL_CACHE_SECRET"))`.
+    # The `secret` should be a stable value stored outside of the cache directory.
+    # When it isn't provided, a process-local secret is generated and cache entries
+    # are rebuilt after the process restarts. Pass `secret: nil` to disable cache
+    # signing. This should only be used when the cache directory is trusted.
     # This will create a directory (`tmp/cache/graphql` by default) that stores a cache of parsed files.
     #
     # Much like [bootsnap](https://github.com/Shopify/bootsnap), the parser cache needs to be cleaned up manually.
@@ -18,32 +25,95 @@ module GraphQL
     #
     # @see GraphQL::Railtie for simple Rails integration
     class Cache
-      def initialize(path)
+      # @param path [Pathname] The directory where cache entries are stored.
+      # @param secret [String, nil] A stable secret for verifying cache entries. When omitted,
+      #   a process-local secret is generated. Pass `nil` to disable cache signing.
+      def initialize(path, secret: SecureRandom.random_bytes(32))
         @path = path
+        @secret = secret
       end
 
       DIGEST = Digest::SHA256.new << GraphQL::VERSION
+      HMAC_SIZE = OpenSSL::Digest::SHA256.new.digest_length
+      InvalidCache = Class.new(StandardError)
+      private_constant :InvalidCache
 
       def fetch(filename)
-        hash = DIGEST.dup << filename
+        cache_key = cache_key_for(filename)
+        return yield unless cache_key
+
+        cache_path = @path.join(cache_key)
+
+        begin
+          return load_cache(cache_path, cache_key) if cache_path.file?
+        rescue InvalidCache, SystemCallError
+          # Rebuild caches created by older versions or with an invalid signature.
+        end
+
+        payload = yield
         begin
-          hash << File.mtime(filename).to_i.to_s
+          write_cache(cache_path, cache_key, payload)
         rescue SystemCallError
-          return yield
+          # Parser caching is best-effort; return the parsed payload if the cache cannot be written.
         end
-        cache_path = @path.join(hash.to_s)
+        payload
+      end
+
+      private
+
+      def cache_key_for(filename)
+        content_digest = Digest::SHA256.file(filename).hexdigest
+        (DIGEST.dup << filename << content_digest).to_s
+      rescue SystemCallError
+        nil
+      end
+
+      def load_cache(cache_path, cache_key)
+        cache_data = cache_path.binread
+        return Marshal.load(cache_data) unless @secret
+
+        signature = cache_data.byteslice(0, HMAC_SIZE)
+        payload = cache_data.byteslice(HMAC_SIZE..-1)
+        raise InvalidCache unless signature && payload
 
-        if cache_path.exist?
-          Marshal.load(cache_path.read)
+        expected_signature = signature_for(cache_key, payload)
+        unless secure_compare(signature, expected_signature)
+          raise InvalidCache
+        end
+        Marshal.load(payload)
+      end
+
+      def write_cache(cache_path, cache_key, payload)
+        @path.mkpath
+        serialized_payload = Marshal.dump(payload)
+        cache_data = if @secret
+          signature_for(cache_key, serialized_payload) + serialized_payload
         else
-          payload = yield
-          tmp_path = "#{cache_path}.#{rand}"
+          serialized_payload
+        end
+
+        Tempfile.create(['graphql-cache-', '.tmp'], @path.to_s) do |tempfile|
+          tempfile.binmode
+          tempfile.write(cache_data)
+          tempfile.flush
+          tempfile.fsync
+          tempfile.close
+          File.rename(tempfile.path, cache_path.to_s)
+        end
+      end
+
+      def signature_for(cache_key, payload)
+        OpenSSL::HMAC.digest('SHA256', @secret, cache_key + payload)
+      end
+
+      def secure_compare(left, right)
+        return false unless left.bytesize == right.bytesize
 
-          @path.mkpath
-          File.binwrite(tmp_path, Marshal.dump(payload))
-          File.rename(tmp_path, cache_path.to_s)
-          payload
+        result = 0
+        left.bytes.each_with_index do |byte, index|
+          result |= byte ^ right.getbyte(index)
         end
+        result.zero?
       end
     end
   end

data/lib/graphql/language/lexer.rb

@@ -9,6 +9,9 @@ module GraphQL
         end
         @string = graphql_str
         @filename = filename
+        if !@string.valid_encoding?
+          raise_parse_error("Parse error on bad Unicode escape sequence", nil, nil)
+        end
         @scanner = StringScanner.new(graphql_str)
         @pos = nil
         @max_tokens = max_tokens || Float::INFINITY
@@ -110,10 +113,6 @@ module GraphQL
           @scanner.pos += 1
           :UNKNOWN_CHAR
         end
-      rescue ArgumentError => err
-        if err.message == "invalid byte sequence in UTF-8"
-          raise_parse_error("Parse error on bad Unicode escape sequence", nil, nil)
-        end
       end
 
       def token_value
@@ -147,7 +146,7 @@ module GraphQL
         "\\r" => "\r",
         "\\t" => "\t",
       }
-      UTF_8 = /\\u(?:([\dAa-f]{4})|\{([\da-f]{4,})\})(?:\\u([\dAa-f]{4}))?/i
+      UTF_8 = /\\u(?:([\da-f]{4})|\{([\da-f]+)\})(?:\\u([\da-f]{4}))?/i
       VALID_STRING = /\A(?:[^\\]|#{ESCAPES}|#{UTF_8})*\z/o
       ESCAPED = /(?:#{ESCAPES}|#{UTF_8})/o
 
@@ -163,7 +162,11 @@ module GraphQL
           if !str.valid_encoding? || !str.match?(VALID_STRING)
             raise_parse_error("Bad unicode escape in #{str.inspect}")
           else
-            Lexer.replace_escaped_characters_in_place(str)
+            begin
+              Lexer.replace_escaped_characters_in_place(str)
+            rescue RangeError
+              raise_parse_error("Bad unicode escape in #{str.inspect}")
+            end
 
             if !str.valid_encoding?
               raise_parse_error("Bad unicode escape in #{str.inspect}")
@@ -175,11 +178,14 @@ module GraphQL
       end
 
       def line_number
-        @scanner.string[0..@pos].count("\n") + 1
+        @scanner.string.byteslice(0, @pos).b.count("\n".b) + 1
       end
 
       def column_number
-        @scanner.string[0..@pos].split("\n").last.length
+        line_prefix = @scanner.string.byteslice(0, @pos)
+        line_prefix = line_prefix.b unless line_prefix.valid_encoding?
+        newline_index = line_prefix.rindex("\n")
+        newline_index ? line_prefix.length - newline_index : line_prefix.length + 1
       end
 
       def raise_parse_error(message, line = line_number, col = column_number)
@@ -286,7 +292,7 @@ module GraphQL
       QUOTE =         '"'
       UNICODE_DIGIT = /[0-9A-Za-z]/
       FOUR_DIGIT_UNICODE = /#{UNICODE_DIGIT}{4}/
-      N_DIGIT_UNICODE = %r{#{Punctuation::LCURLY}#{UNICODE_DIGIT}{4,}#{Punctuation::RCURLY}}x
+      N_DIGIT_UNICODE = %r{#{Punctuation::LCURLY}#{UNICODE_DIGIT}+#{Punctuation::RCURLY}}x
       UNICODE_ESCAPE = %r{\\u(?:#{FOUR_DIGIT_UNICODE}|#{N_DIGIT_UNICODE})}
       STRING_ESCAPE = %r{[\\][\\/bfnrt]}
       BLOCK_QUOTE =   '"""'

data/lib/graphql/language/nodes.rb

@@ -304,7 +304,8 @@ module GraphQL
                 children_method_names.map { |m| "#{m}: NO_CHILDREN" } +
                 DEFAULT_INITIALIZE_OPTIONS
 
-              assignments = scalar_method_names.map { |m| "@#{m} = #{m}"} +
+              # Intern descriptions so identical strings across SDL documents share one frozen object.
+              assignments = scalar_method_names.map { |m| m == :description ? "@#{m} = #{m} && -#{m}" : "@#{m} = #{m}" } +
                 children_method_names.map { |m| "@#{m} = #{m}.freeze" }
 
               if name.end_with?("Definition") && name != "FragmentDefinition"

data/lib/graphql/language.rb

@@ -31,11 +31,11 @@ module GraphQL
 
         "[#{serialized_array}]"
       else
-        JSON.generate(value, quirks_mode: true)
+        JSON.generate(value)
       end
     rescue JSON::GeneratorError
-      if Float::INFINITY == value
-        "Infinity"
+      if value.is_a?(Float) && !value.finite?
+        value.to_s
       else
         raise
       end

data/lib/graphql/pagination/relation_connection.rb

@@ -221,7 +221,16 @@ module GraphQL
       # returns an array of nodes
       def load_nodes
         # Return an array so we can consistently use `.index(node)` on it
-        @nodes ||= limited_nodes.to_a
+        return @nodes if @nodes
+        if (@context[:dataloader].is_a?(GraphQL::Dataloader::AsyncDataloader))
+          # `AsyncDataloader` may resolve sibling fields (eg, `edges` and `pageInfo`)
+          # in separate Fibers, so several callers can get here before `@nodes` is set.
+          (@load_lock ||= Mutex.new).synchronize do
+            @nodes ||= limited_nodes.to_a
+          end
+        else
+          @nodes = limited_nodes.to_a
+        end
       end
     end
   end

data/lib/graphql/query/variable_validation_error.rb

@@ -22,7 +22,7 @@ module GraphQL
         # It is possible there are other extension items in this error, so handle
         # a one level deep merge explicitly. However beyond that only show the
         # latest value and problems.
-        super.merge({ "extensions" => { "value" => value, "problems" => validation_result.problems }}) do |key, oldValue, newValue|
+        super.merge({ "extensions" => { "value" => value_for_extensions, "problems" => validation_result.problems }}) do |key, oldValue, newValue|
           if oldValue.respond_to?(:merge)
             oldValue.merge(newValue)
           else
@@ -33,6 +33,21 @@ module GraphQL
 
       private
 
+      def value_for_extensions(value = @value)
+        case value
+        when Array
+          value.map { |item| value_for_extensions(item) }
+        when Hash
+          value.each_with_object({}) do |(key, item), result|
+            result[key] = value_for_extensions(item)
+          end
+        when Float
+          value.finite? ? value : value.to_s
+        else
+          value
+        end
+      end
+
       def problem_fields
         @problem_fields ||= @validation_result
           .problems

data/lib/graphql/query/variables.rb

@@ -19,7 +19,7 @@ module GraphQL
         @storage = ast_variables.each_with_object({}) do |ast_variable, memo|
           if schema.validate_max_errors && schema.validate_max_errors <= @errors.count
             add_max_errors_reached_message
-            break
+            break memo
           end
           # Find the right value for this variable:
           # - First, use the value provided at runtime

data/lib/graphql/railtie.rb

@@ -15,7 +15,8 @@ module GraphQL
     initializer("graphql.cache") do |app|
       if config.graphql.parser_cache
         Language::Parser.cache ||= Language::Cache.new(
-          app.root.join("tmp/cache/graphql")
+          app.root.join("tmp/cache/graphql"),
+          secret: app.secret_key_base
         )
       end
     end

data/lib/graphql/schema/build_from_definition.rb

@@ -82,6 +82,7 @@ module GraphQL
           replace_late_bound_types_with_built_in(types)
 
           schema_extensions = nil
+          definitions_by_name = nil
           document.definitions.each do |definition|
             case definition
             when GraphQL::Language::Nodes::SchemaDefinition, GraphQL::Language::Nodes::DirectiveDefinition
@@ -101,9 +102,16 @@ module GraphQL
               if prev_type.nil? || prev_type.is_a?(Schema::LateBoundType)
                 if definition.is_a?(GraphQL::Language::Nodes::ObjectTypeDefinition) || definition.is_a?(Language::Nodes::InterfaceTypeDefinition)
                   interface_names = definition.interfaces.map(&:name)
-                  transitive_names = interface_names.map { |n| document.definitions.find { |d| d.respond_to?(:name) && d.name == n }&.interfaces&.map(&:name) }
-                  transitive_names.flatten!
-                  transitive_names.compact!
+                  if !interface_names.empty?
+                    definitions_by_name ||= document.definitions.each_with_object({}) do |d, by_name|
+                      by_name[d.name] ||= d if d.respond_to?(:name)
+                    end
+                    transitive_names = interface_names.map { |n| definitions_by_name[n]&.interfaces&.map(&:name) }
+                    transitive_names.flatten!
+                    transitive_names.compact!
+                  else
+                    transitive_names = interface_names
+                  end
                   if !(missing_transitive_interfaces = transitive_names - interface_names).empty?
                     raise GraphQL::Schema::InvalidDocumentError, "type #{definition.name} is missing one or more transitive interface names: #{missing_transitive_interfaces.join(", ")}. Add them to the type's `implements` list and try again."
                   end

data/lib/graphql/schema/directive.rb

@@ -168,6 +168,9 @@ module GraphQL
               # Let validation handle this
               value
             end
+          elsif arg_defn.default_value?
+            value = arg_defn.default_value
+            graphql_value = arg_type.coerce_isolated_result(value) unless value.nil?
           else
             value = graphql_value = nil
           end

data/lib/graphql/schema/input_object.rb

@@ -172,12 +172,12 @@ module GraphQL
           types = ctx.types
 
           if input.is_a?(Array)
-            return GraphQL::Query::InputValidationResult.from_problem(INVALID_OBJECT_MESSAGE % { object: JSON.generate(input, quirks_mode: true) })
+            return GraphQL::Query::InputValidationResult.from_problem(INVALID_OBJECT_MESSAGE % { object: JSON.generate(input) })
           end
 
           if !(input.respond_to?(:to_h) || input.respond_to?(:to_unsafe_h))
             # We're not sure it'll act like a hash, so reject it:
-            return GraphQL::Query::InputValidationResult.from_problem(INVALID_OBJECT_MESSAGE % { object: JSON.generate(input, quirks_mode: true) })
+            return GraphQL::Query::InputValidationResult.from_problem(INVALID_OBJECT_MESSAGE % { object: JSON.generate(input) })
           end
 
 

data/lib/graphql/schema/resolver.rb

@@ -83,7 +83,7 @@ module GraphQL
             is_authed, new_return_value = authorized?(**@prepared_arguments)
           rescue GraphQL::UnauthorizedError  => err
             new_return_value = q.schema.unauthorized_object(err)
-            is_authed = true # the error was handled
+            is_authed = false
           end
         end
 

data/lib/graphql/schema/wrapper.rb

@@ -25,6 +25,10 @@ module GraphQL
       def ==(other)
         self.class == other.class && of_type == other.of_type
       end
+
+      def deconstruct_keys(_keys)
+        { of_type: of_type }
+      end
     end
   end
 end

data/lib/graphql/schema.rb

@@ -665,8 +665,8 @@ module GraphQL
           inherited_um = find_inherited_value(:union_memberships, EMPTY_HASH).fetch(type.graphql_name, EMPTY_ARRAY)
           own_um + inherited_um
         else
-          joined_um = own_union_memberships.dup
-          find_inherited_value(:union_memberhips, EMPTY_HASH).each do |k, v|
+          joined_um = own_union_memberships.transform_values(&:dup)
+          find_inherited_value(:union_memberships, EMPTY_HASH).each do |k, v|
             um = joined_um[k] ||= []
             um.concat(v)
           end
@@ -860,7 +860,7 @@ module GraphQL
       # @return [Array<GraphQL::StaticValidation::Error >]
       def validate(string_or_document, rules: nil, context: nil)
         doc = if string_or_document.is_a?(String)
-          GraphQL.parse(string_or_document)
+          GraphQL.parse(string_or_document, max_tokens: max_query_string_tokens)
         else
           string_or_document
         end
@@ -1338,9 +1338,9 @@ module GraphQL
 
           context.errors << execution_error
           execution_error
-        when GraphQL::UnresolvedTypeError, GraphQL::StringEncodingError, GraphQL::IntegerEncodingError
+        when GraphQL::UnresolvedTypeError, GraphQL::StringEncodingError, GraphQL::FloatEncodingError, GraphQL::IntegerEncodingError
           raise type_error
-        when GraphQL::IntegerDecodingError
+        when GraphQL::FloatDecodingError, GraphQL::IntegerDecodingError
           nil
         end
       end

data/lib/graphql/static_validation/rules/fields_will_merge.rb

@@ -15,6 +15,8 @@ module GraphQL
       # separately (which leads to exponential recursion through nested fragments),
       # we flatten all fragment spreads into a single field map and compare within it.
       NO_ARGS = GraphQL::EmptyObjects::EMPTY_HASH
+      EXCLUSIVE_COMPARISON = 1
+      NONEXCLUSIVE_COMPARISON = 2
 
       class Field
         attr_reader :node, :definition, :owner_type, :parents
@@ -33,6 +35,10 @@ module GraphQL
         def unwrapped_return_type
           @unwrapped_return_type ||= return_type&.unwrap
         end
+
+        def comparison_key
+          @comparison_key ||= [@node, @parents]
+        end
       end
 
       def initialize(*)
@@ -43,6 +49,9 @@ module GraphQL
         # Track which sub-selection node pairs have been compared to prevent
         # infinite recursion with cyclic fragments
         @compared_sub_selections = {}.compare_by_identity
+        @compared_field_groups = {}
+        @field_group_signatures = {}.compare_by_identity
+        @field_selection_signatures = {}.compare_by_identity
         # Cache mutually_exclusive? results for type pairs
         @mutually_exclusive_cache = {}.compare_by_identity
         # Cache collect_fields results for sub-selection comparison
@@ -215,21 +224,7 @@ module GraphQL
             end
 
             if all_same
-              # All fields share a signature, so they can only conflict on
-              # sub-selections. Deduplicate by AST node identity — fields from
-              # the same node always have identical sub-selections.
-              unique_nodes = fields.uniq { |f| f.node.object_id }
-              i = 0
-              while i < unique_nodes.size
-                j = i + 1
-                while j < unique_nodes.size
-                  if unique_nodes[i].node.selections.size > 0 || unique_nodes[j].node.selections.size > 0
-                    find_conflict(key, unique_nodes[i], unique_nodes[j])
-                  end
-                  j += 1
-                end
-                i += 1
-              end
+              find_conflicts_between_selection_groups(key, fields)
             else
               groups = fields.group_by { |f| field_signature(f) }
               unique_groups = groups.values
@@ -243,22 +238,10 @@ module GraphQL
                   gj += 1
                 end
 
-                # Within same group, deduplicate by AST node and compare all
-                # pairs for sub-selection conflicts
+                # Within the same group, fields can only conflict on sub-selections.
                 group = unique_groups[gi]
                 if group.size >= 2
-                  unique_in_group = group.uniq { |f| f.node.object_id }
-                  ui = 0
-                  while ui < unique_in_group.size
-                    uj = ui + 1
-                    while uj < unique_in_group.size
-                      if unique_in_group[ui].node.selections.size > 0 || unique_in_group[uj].node.selections.size > 0
-                        find_conflict(key, unique_in_group[ui], unique_in_group[uj])
-                      end
-                      uj += 1
-                    end
-                    ui += 1
-                  end
+                  find_conflicts_between_selection_groups(key, group)
                 end
 
                 gi += 1
@@ -279,6 +262,29 @@ module GraphQL
         end
       end
 
+      def find_conflicts_between_selection_groups(response_key, fields)
+        fields_by_selection = {}
+        fields.each do |field|
+          fields_by_selection[field_selection_signature(field)] ||= field
+        end
+
+        representatives = fields_by_selection.values
+        i = 0
+        while i < representatives.size
+          j = i + 1
+          while j < representatives.size
+            find_conflict(response_key, representatives[i], representatives[j])
+            j += 1
+          end
+          i += 1
+        end
+      end
+
+      def field_selection_signature(field)
+        node = field.node
+        @field_selection_signatures[node] ||= node.selections.map(&:to_query_string)
+      end
+
       def fields_same_signature?(f1, f2)
         n1 = f1.node
         n2 = f2.node
@@ -458,6 +464,7 @@ module GraphQL
         response_keys.each do |key, fields|
           fields2 = response_keys2[key]
           next unless fields2
+          next if field_groups_already_compared?(fields, fields2, mutually_exclusive)
 
           fields_arr = fields.is_a?(Field) ? [fields] : fields
           fields2_arr = fields2.is_a?(Field) ? [fields2] : fields2
@@ -475,6 +482,36 @@ module GraphQL
         end
       end
 
+      def field_groups_already_compared?(fields, fields2, mutually_exclusive)
+        signature1 = field_group_signature(fields)
+        signature2 = field_group_signature(fields2)
+        previous_comparisons = @compared_field_groups[signature1]
+        comparison_state = previous_comparisons && previous_comparisons[signature2]
+
+        if mutually_exclusive
+          return true if comparison_state
+          new_state = EXCLUSIVE_COMPARISON
+        else
+          return true if comparison_state == NONEXCLUSIVE_COMPARISON
+          new_state = NONEXCLUSIVE_COMPARISON
+        end
+
+        previous_comparisons ||= (@compared_field_groups[signature1] = {})
+        previous_comparisons[signature2] = new_state
+
+        reverse_comparisons = @compared_field_groups[signature2] ||= {}
+        reverse_comparisons[signature1] = new_state
+        false
+      end
+
+      def field_group_signature(fields)
+        if fields.is_a?(Field)
+          fields.comparison_key
+        else
+          @field_group_signatures[fields] ||= fields.map(&:comparison_key)
+        end
+      end
+
       def same_arguments?(field1, field2)
         arguments1 = field1.arguments
         arguments2 = field2.arguments