@strapi/plugin-graphql 4.13.0-beta.0 → 4.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-graphql",
-  "version": "4.13.0-beta.0",
+  "version": "4.13.1",
   "description": "Adds GraphQL endpoint with default API methods.",
   "repository": {
     "type": "git",
@@ -27,9 +27,9 @@
     "@graphql-tools/schema": "8.5.1",
     "@graphql-tools/utils": "^8.13.1",
     "@strapi/design-system": "1.9.0",
-    "@strapi/helper-plugin": "4.13.0-beta.0",
+    "@strapi/helper-plugin": "4.13.1",
     "@strapi/icons": "1.9.0",
-    "@strapi/utils": "4.13.0-beta.0",
+    "@strapi/utils": "4.13.1",
     "apollo-server-core": "3.12.0",
     "apollo-server-koa": "3.10.0",
     "glob": "7.2.3",
@@ -68,5 +68,5 @@
     "description": "Adds GraphQL endpoint with default API methods.",
     "kind": "plugin"
   },
-  "gitHead": "f1b8431a6a0b7f9bd9a8444adb56217bba91ec07"
+  "gitHead": "a9afeb90c525d9b8ab033aa0c87e03a72134e0dd"
 }

package/server/services/builders/mutations/single-type.js

@@ -5,7 +5,7 @@ const { omit, isNil } = require('lodash/fp');
 
 const utils = require('@strapi/utils');
 
-const { sanitize } = utils;
+const { sanitize, validate } = utils;
 const { NotFoundError } = utils.errors;
 
 module.exports = ({ strapi }) => {
@@ -53,6 +53,13 @@ module.exports = ({ strapi }) => {
           .get('content-api')
           .buildMutationsResolvers({ contentType });
 
+        // For single types, the validation and sanitization of args is done here instead of being
+        // delegated to the query builders since we're calling the entity service directly
+
+        await validate.contentAPI.query(omit(['data', 'files'], transformedArgs), contentType, {
+          auth,
+        });
+
         const sanitizedQuery = await sanitize.contentAPI.query(
           omit(['data', 'files'], transformedArgs),
           contentType,
@@ -91,6 +98,11 @@ module.exports = ({ strapi }) => {
           .get('content-api')
           .buildMutationsResolvers({ contentType });
 
+        // For single types, the validation and sanitization of args is done here instead of being
+        // delegated to the query builders since we're calling the entity service directly
+
+        await validate.contentAPI.query(transformedArgs, contentType, { auth: ctx?.state?.auth });
+
         const sanitizedQuery = await sanitize.contentAPI.query(transformedArgs, contentType, {
           auth: ctx?.state?.auth,
         });

package/server/services/builders/resolvers/association.js

@@ -4,7 +4,7 @@ const { get } = require('lodash/fp');
 
 const utils = require('@strapi/utils');
 
-const { sanitize, pipeAsync } = utils;
+const { sanitize, validate, pipeAsync } = utils;
 const { ApplicationError } = utils.errors;
 
 module.exports = ({ strapi }) => {
@@ -41,6 +41,9 @@ module.exports = ({ strapi }) => {
           usePagination: true,
         });
 
+        await validate.contentAPI.query(transformedArgs, targetContentType, {
+          auth,
+        });
         const sanitizedQuery = await sanitize.contentAPI.query(transformedArgs, targetContentType, {
           auth,
         });

package/server/services/builders/resolvers/component.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { sanitize } = require('@strapi/utils');
+const { sanitize, validate } = require('@strapi/utils');
 
 module.exports = ({ strapi }) => ({
   buildComponentResolver({ contentTypeUID, attributeName }) {
@@ -13,6 +13,9 @@ module.exports = ({ strapi }) => ({
       const component = strapi.getModel(componentName);
 
       const transformedArgs = transformArgs(args, { contentType: component, usePagination: true });
+      await validate.contentAPI.query(transformedArgs, contentType, {
+        auth: ctx?.state?.auth,
+      });
       const sanitizedQuery = await sanitize.contentAPI.query(transformedArgs, contentType, {
         auth: ctx?.state?.auth,
       });

package/server/services/builders/resolvers/mutation.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { pick } = require('lodash/fp');
-const { sanitize } = require('@strapi/utils');
+const { sanitize, validate } = require('@strapi/utils');
 
 const pickCreateArgs = pick(['params', 'data', 'files']);
 
@@ -25,7 +25,10 @@ module.exports = ({ strapi }) => ({
 
       async delete(parent, args, ctx) {
         const { id, ...rest } = args;
-        const sanitizedQuery = sanitize.contentAPI.query(rest, contentType, {
+        await validate.contentAPI.query(rest, contentType, {
+          auth: ctx?.state?.auth,
+        });
+        const sanitizedQuery = await sanitize.contentAPI.query(rest, contentType, {
           auth: ctx?.state?.auth,
         });
         return strapi.entityService.delete(uid, id, sanitizedQuery);

package/server/services/builders/resolvers/query.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { omit } = require('lodash/fp');
-const { sanitize } = require('@strapi/utils');
+const { sanitize, validate } = require('@strapi/utils');
 
 module.exports = ({ strapi }) => ({
   buildQueriesResolvers({ contentType }) {
@@ -9,6 +9,9 @@ module.exports = ({ strapi }) => ({
 
     return {
       async find(parent, args, ctx) {
+        await validate.contentAPI.query(args, contentType, {
+          auth: ctx?.state?.auth,
+        });
         const sanitizedQuery = await sanitize.contentAPI.query(args, contentType, {
           auth: ctx?.state?.auth,
         });
@@ -17,6 +20,9 @@ module.exports = ({ strapi }) => ({
       },
 
       async findOne(parent, args, ctx) {
+        await validate.contentAPI.query(args, contentType, {
+          auth: ctx?.state?.auth,
+        });
         const sanitizedQuery = await sanitize.contentAPI.query(args, contentType, {
           auth: ctx?.state?.auth,
         });

package/server/services/internals/types/response-collection-meta.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { objectType } = require('nexus');
-const { sanitize } = require('@strapi/utils');
+const { sanitize, validate } = require('@strapi/utils');
 
 module.exports = ({ strapi }) => {
   const { RESPONSE_COLLECTION_META_TYPE_NAME, PAGINATION_TYPE_NAME } = strapi
@@ -26,7 +26,9 @@ module.exports = ({ strapi }) => {
             const { start, limit } = args;
             const safeLimit = Math.max(limit, 1);
             const contentType = strapi.getModel(resourceUID);
-
+            await validate.contentAPI.query(args, contentType, {
+              auth: ctx?.state?.auth,
+            });
             const sanitizedQuery = await sanitize.contentAPI.query(args, contentType, {
               auth: ctx?.state?.auth,
             });