graphql 2.6.8 → 2.6.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 12ae3a5cc9e399639228a8ccfc1654c7bcaf73a6c81339ad72f7ce90b159eb9d
-  data.tar.gz: a998bd1576174777857e365cbe67ffc7b68273bbaa17ad0cd1e609193254417f
+  metadata.gz: 6a359d53729477046ffd6b51ef9345099defcdc95521579711fffe5ab79c0b5e
+  data.tar.gz: 4c88aecd90fb26e02198f21f4bdf7a73f577ec37ac9ea9eb6c840c8a2957fc7a
 SHA512:
-  metadata.gz: 2c95b6f2c0aec486d42170e970f59272ece87e9433c5ba8e3fff4838da802993f1de9fcaf3b2c2807fb3365674a7a915265c248470987bf0a9f47d13b90699d1
-  data.tar.gz: 03eb4c0fb7cddfd2cebce9a50ce3a9264f6473d4ca037e8a60ddb5d14b3f880a54c6b249958b2b58100dca9ea9b3ad9de04ad25cd333f0d00e620fd724ff7ff6
+  metadata.gz: d40bb56d8b5e77ca6f126f1528e2a074bbf679996dfb8ea5a12d646d028d547848dc36dea3a5fb73273fb7252135a5c7e904ec7d0a38790fe05164c5e81701b5
+  data.tar.gz: e486b9492693cdc69375f8d3bc662e075a71ff45642f62cb2fd741959b2a2d1f9105fa14718b992ef2d3b3a809fd0f0d94ec66abf509137b3a7af05877527c23

data/lib/graphql/language/cache.rb

@@ -2,6 +2,9 @@
 
 require 'graphql/version'
 require 'digest/sha2'
+require 'openssl'
+require 'securerandom'
+require 'tempfile'
 
 module GraphQL
   module Language
@@ -9,7 +12,11 @@ module GraphQL
     #
     # With Rails, parser caching may enabled by setting `config.graphql.parser_cache = true` in your Rails application.
     #
-    # The cache may be manually built by assigning `GraphQL::Language::Parser.cache = GraphQL::Language::Cache.new("some_dir")`.
+    # The cache may be manually built by assigning `GraphQL::Language::Parser.cache = GraphQL::Language::Cache.new(Pathname.new("some_dir"), secret: ENV.fetch("GRAPHQL_CACHE_SECRET"))`.
+    # The `secret` should be a stable value stored outside of the cache directory.
+    # When it isn't provided, a process-local secret is generated and cache entries
+    # are rebuilt after the process restarts. Pass `secret: nil` to disable cache
+    # signing. This should only be used when the cache directory is trusted.
     # This will create a directory (`tmp/cache/graphql` by default) that stores a cache of parsed files.
     #
     # Much like [bootsnap](https://github.com/Shopify/bootsnap), the parser cache needs to be cleaned up manually.
@@ -18,32 +25,95 @@ module GraphQL
     #
     # @see GraphQL::Railtie for simple Rails integration
     class Cache
-      def initialize(path)
+      # @param path [Pathname] The directory where cache entries are stored.
+      # @param secret [String, nil] A stable secret for verifying cache entries. When omitted,
+      #   a process-local secret is generated. Pass `nil` to disable cache signing.
+      def initialize(path, secret: SecureRandom.random_bytes(32))
         @path = path
+        @secret = secret
       end
 
       DIGEST = Digest::SHA256.new << GraphQL::VERSION
+      HMAC_SIZE = OpenSSL::Digest::SHA256.new.digest_length
+      InvalidCache = Class.new(StandardError)
+      private_constant :InvalidCache
 
       def fetch(filename)
-        hash = DIGEST.dup << filename
+        cache_key = cache_key_for(filename)
+        return yield unless cache_key
+
+        cache_path = @path.join(cache_key)
+
+        begin
+          return load_cache(cache_path, cache_key) if cache_path.file?
+        rescue InvalidCache, SystemCallError
+          # Rebuild caches created by older versions or with an invalid signature.
+        end
+
+        payload = yield
         begin
-          hash << File.mtime(filename).to_i.to_s
+          write_cache(cache_path, cache_key, payload)
         rescue SystemCallError
-          return yield
+          # Parser caching is best-effort; return the parsed payload if the cache cannot be written.
         end
-        cache_path = @path.join(hash.to_s)
+        payload
+      end
+
+      private
+
+      def cache_key_for(filename)
+        content_digest = Digest::SHA256.file(filename).hexdigest
+        (DIGEST.dup << filename << content_digest).to_s
+      rescue SystemCallError
+        nil
+      end
+
+      def load_cache(cache_path, cache_key)
+        cache_data = cache_path.binread
+        return Marshal.load(cache_data) unless @secret
+
+        signature = cache_data.byteslice(0, HMAC_SIZE)
+        payload = cache_data.byteslice(HMAC_SIZE..-1)
+        raise InvalidCache unless signature && payload
 
-        if cache_path.exist?
-          Marshal.load(cache_path.read)
+        expected_signature = signature_for(cache_key, payload)
+        unless secure_compare(signature, expected_signature)
+          raise InvalidCache
+        end
+        Marshal.load(payload)
+      end
+
+      def write_cache(cache_path, cache_key, payload)
+        @path.mkpath
+        serialized_payload = Marshal.dump(payload)
+        cache_data = if @secret
+          signature_for(cache_key, serialized_payload) + serialized_payload
         else
-          payload = yield
-          tmp_path = "#{cache_path}.#{rand}"
+          serialized_payload
+        end
+
+        Tempfile.create(['graphql-cache-', '.tmp'], @path.to_s) do |tempfile|
+          tempfile.binmode
+          tempfile.write(cache_data)
+          tempfile.flush
+          tempfile.fsync
+          tempfile.close
+          File.rename(tempfile.path, cache_path.to_s)
+        end
+      end
+
+      def signature_for(cache_key, payload)
+        OpenSSL::HMAC.digest('SHA256', @secret, cache_key + payload)
+      end
+
+      def secure_compare(left, right)
+        return false unless left.bytesize == right.bytesize
 
-          @path.mkpath
-          File.binwrite(tmp_path, Marshal.dump(payload))
-          File.rename(tmp_path, cache_path.to_s)
-          payload
+        result = 0
+        left.bytes.each_with_index do |byte, index|
+          result |= byte ^ right.getbyte(index)
         end
+        result.zero?
       end
     end
   end

data/lib/graphql/railtie.rb

@@ -15,7 +15,8 @@ module GraphQL
     initializer("graphql.cache") do |app|
       if config.graphql.parser_cache
         Language::Parser.cache ||= Language::Cache.new(
-          app.root.join("tmp/cache/graphql")
+          app.root.join("tmp/cache/graphql"),
+          secret: app.secret_key_base
         )
       end
     end

data/lib/graphql/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module GraphQL
-  VERSION = "2.6.8"
+  VERSION = "2.6.9"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: graphql
 version: !ruby/object:Gem::Version
-  version: 2.6.8
+  version: 2.6.9
 platform: ruby
 authors:
 - Robert Mosolgo
 bindir: bin
 cert_chain: []
-date: 2026-08-13 00:00:00.000000000 Z
+date: 2026-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64