kinetex 1.3.0 → 1.5.0

package/dist/cjs/graphql.js

@@ -30,6 +30,8 @@ import { ValidationError } from "./types.js";
 // FIX (H6): untrusted GraphQL responses are parsed with raw JSON.parse below —
 // sanitize prototype-pollution keys before they reach user code or merges.
 import { sanitizeParsedJSON } from "./utils.js";
+import { sleep } from "./utils.js";
+import { sha256Hex } from "./utils.js";
 // ============================================================================
 // §2  ERRORS
 // ============================================================================
@@ -82,9 +84,6 @@ function buildGraphQLError(graphQLErrors, req, res) {
     return new GraphQLClientError(message, "EGRAPHQL", graphQLErrors, req, res);
 }
 // Utility function (B-10 fix - moved before usage)
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
 function buildLinkChain(links, terminal) {
     return links.reduceRight((next, link) => (op) => link(op, next), terminal);
 }
@@ -121,14 +120,6 @@ export function extractOperationName(query) {
 // ============================================================================
 // §5  AUTOMATIC PERSISTED QUERIES (APQ)
 // ============================================================================
-async function sha256Hex(str) {
-    const encoded = new TextEncoder().encode(str);
-    const buf = encoded.buffer.slice(encoded.byteOffset, encoded.byteOffset + encoded.byteLength);
-    const hash = await crypto.subtle.digest("SHA-256", buf);
-    return Array.from(new Uint8Array(hash))
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
-}
 /** Maximum APQ cache entries to prevent memory leaks */
 const MAX_APQ_CACHE_ENTRIES = 1000;
 /** APQ cache entry TTL in ms — entries older than this are evicted */
@@ -179,6 +170,72 @@ const MALICIOUS_QUERY_PATTERNS = [
     /onerror\s*=/i, // Event handler injection (onerror=, onclick=, etc.)
     /eval\s*\(/i, // Code execution via eval()
 ];
+/**
+ * Blank out the contents of every GraphQL string literal, preserving the
+ * document's length so the surrounding structure is unchanged.
+ *
+ * Both the injection scan and the brace counter used to read string literals
+ * as if they were code, so a query the caller was entitled to send was
+ * rejected:
+ *
+ * - `{ search(term: "javascript:void(0)") }` -> "malicious pattern: /javascript:/"
+ * - `{ run(code: "eval(x)") }`               -> "malicious pattern: /eval\s*\(/"
+ * - `{ page(html: "<div onerror=alert(1)>") }` -> "malicious pattern: /onerror\s*=/"
+ * - `{ css(v: "<!-- hi -->") }`              -> "malicious pattern: /<!--/"
+ * - `{ a(s: "}") b }`                        -> "GraphQL query has unbalanced braces"
+ * - `{ f(x: "{{") }`                         -> "malicious pattern: /\{\s*\{/"
+ *
+ * A client refusing to transmit a well-formed query is a hard failure for the
+ * caller, and none of these is a client-side hazard: what the *server* renders
+ * from a string it was sent is the server's responsibility to escape, which is
+ * precisely what a scan of the request text cannot check. The patterns stay
+ * exactly as strict for text *outside* string literals, which is where a
+ * malformed or hostile document actually shows up.
+ *
+ * Handles `"..."`, the block forms `"""..."""` and `'''...'''`, and `#`
+ * comments, and leaves an unterminated quote alone so the structural checks
+ * still see it.
+ */
+function maskGraphQLLiterals(query) {
+    const out = query.split("");
+    let i = 0;
+    const n = query.length;
+    while (i < n) {
+        const ch = query[i];
+        // Comment to end of line.
+        if (ch === "#") {
+            while (i < n && query[i] !== "\n")
+                out[i++] = " ";
+            continue;
+        }
+        // Block string: """ or '''.
+        if ((ch === '"' || ch === "'") && query[i + 1] === ch && query[i + 2] === ch) {
+            const delim = ch.repeat(3);
+            const end = query.indexOf(delim, i + 3);
+            const stop = end === -1 ? n : end + 3;
+            while (i < stop)
+                out[i++] = " ";
+            continue;
+        }
+        // Ordinary string.
+        if (ch === '"' || ch === "'") {
+            const quote = ch;
+            out[i] = " ";
+            i++;
+            while (i < n && query[i] !== quote && query[i] !== "\n") {
+                out[i] = " ";
+                i++;
+            }
+            if (i < n && query[i] === quote) {
+                out[i] = " ";
+                i++;
+            }
+            continue;
+        }
+        i++;
+    }
+    return out.join("");
+}
 /**
  * Validate a GraphQL query for safety.
  * Prevents excessively large queries and detects malicious patterns.
@@ -192,17 +249,20 @@ function validateGraphQLQuery(query) {
     if (query.length > MAX_QUERY_LENGTH) {
         throw new ValidationError(`GraphQL query exceeds maximum length of ${MAX_QUERY_LENGTH} bytes`);
     }
+    // Structural checks run on the document with its string literals blanked, so
+    // a brace or a keyword inside a value is treated as data, not as syntax.
+    const structural = maskGraphQLLiterals(query);
     // Check for malicious patterns
     for (const pattern of MALICIOUS_QUERY_PATTERNS) {
-        if (pattern.test(query)) {
+        if (pattern.test(structural)) {
             throw new ValidationError(`GraphQL query contains potentially malicious pattern: ${pattern}`);
         }
     }
     // Basic depth check by counting open braces
     let depth = 0;
     let maxDepth = 0;
-    for (let i = 0; i < query.length; i++) {
-        const char = query[i];
+    for (let i = 0; i < structural.length; i++) {
+        const char = structural[i];
         if (char === "{") {
             depth++;
             maxDepth = Math.max(maxDepth, depth);
@@ -289,12 +349,25 @@ function buildMultipartBody(req, uploads) {
     const form = new FormData();
     // Null out file variables in the operations object
     const operations = JSON.parse(buildJSONBody(req));
-    // Build map: { "0": ["variables.input.file"], "1": [...] }
+    // The multipart spec's `map` paths are rooted at the `operations` object,
+    // and its example is `{"0": ["variables.file"]}` — so the path a caller
+    // passes has to name `variables` for the nulling below to reach the variable
+    // the mutation actually declares. The documented examples here did the
+    // opposite (`path: "file"`, `path: "input.file"`), and they produced
+    // `{"variables": {"file": {}}, "file": null}`: the file was nulled at the
+    // top level of the request object where no variable lives, and the real
+    // variable kept its original value. The upload never bound.
+    //
+    // Both spellings are now accepted, and the map always carries the rooted
+    // form so the request stays spec-conformant.
     const map = {};
     for (let i = 0; i < uploads.length; i++) {
         const upload = uploads[i];
-        map[String(i)] = [upload.path];
-        setNestedValue(operations, upload.path, null);
+        const rooted = upload.path === "variables" || upload.path.startsWith("variables.")
+            ? upload.path
+            : `variables.${upload.path}`;
+        map[String(i)] = [rooted];
+        setNestedValue(operations, rooted, null);
     }
     form.append("operations", JSON.stringify(operations));
     form.append("map", JSON.stringify(map));
@@ -315,8 +388,15 @@ function setNestedValue(obj, path, value) {
         if (key === "__proto__" || key === "constructor" || key === "prototype") {
             throw new ValidationError(`Invalid upload path: "${path}" — reserved key "${key}"`);
         }
+        // Whether this segment is an array or an object is decided by the segment
+        // *after* it: in `files.0` the container `files` holds an index, so it must
+        // be created as an array. Deciding by `key` instead produced `{}`, and the
+        // server then saw `variables.files` as `{"0": null}` — an object, not the
+        // list the mutation declared.
+        const nextIsIndex = /^(0|[1-9][0-9]*)$/.test(parts[i + 1]);
+        const next = nextIsIndex ? [] : {};
         if (!current[key] || typeof current[key] !== "object")
-            current[key] = {};
+            current[key] = next;
         current = current[key];
     }
     const leaf = parts[parts.length - 1];
@@ -348,7 +428,9 @@ async function parseGraphQLResponse(response, req) {
 // §9  CORE EXECUTE FUNCTION
 // ============================================================================
 async function executeHTTP(req, config, signal, apqMode = "none", getAPQHashFn) {
-    const headers = await buildHeaders(config);
+    // `req.headers` is last so a link (or a caller using `raw`) can override a
+    // default. It used to be ignored entirely.
+    const headers = await buildHeaders(config, req.headers ?? {});
     const opType = detectOperationType(req.query);
     const useGET = config.useGETForQueries && opType === "query";
     let fetchUrl = config.url;
@@ -469,8 +551,12 @@ export class GraphQLClient {
             onError: () => { },
             ...config,
         };
-        // Terminal link — does the actual HTTP fetch
-        const terminal = (op) => this._executeWithAPQ(op.request, op.signal ?? null);
+        // Terminal link — does the actual HTTP fetch.
+        // `op.config` is honoured, not just `this.config`: links such as
+        // `authLink` replace it to inject headers, and the terminal previously
+        // discarded the replacement and read the constructor-time object, so
+        // nothing a link put there was ever sent.
+        const terminal = (op) => this._executeWithAPQ(op.request, op.signal ?? null, op.config ?? this.config);
         this.executeLink = buildLinkChain(this.config.links, terminal);
     }
     // ── APQ (Automatic Persisted Queries) ───────────────────────────────────
@@ -570,7 +656,7 @@ export class GraphQLClient {
             ...(variables !== undefined ? { variables } : {}),
             ...(options.operationName !== undefined
                 ? { operationName: options.operationName }
-                : extractOperationName(query) !== undefined
+                : extractOperationName(query) !== null
                     ? { operationName: extractOperationName(query) }
                     : {}),
             ...(options.extensions !== undefined ? { extensions: options.extensions } : {}),
@@ -627,13 +713,11 @@ export class GraphQLClient {
             variables,
             ...(options.operationName !== undefined
                 ? { operationName: options.operationName }
-                : extractOperationName(query) !== undefined
+                : extractOperationName(query) !== null
                     ? { operationName: extractOperationName(query) }
                     : {}),
         };
-        const headers = await buildHeaders(this.config, {
-        /* drop content-type for multipart */
-        });
+        const headers = await buildHeaders(this.config, { /* drop content-type for multipart */});
         delete headers["content-type"]; // FormData sets it with boundary
         const form = buildMultipartBody(req, uploads);
         const controller = new AbortController();
@@ -686,6 +770,12 @@ export class GraphQLClient {
      *   contains GraphQL errors, or is missing data for any request
      */
     async batch(requests, options = {}) {
+        // `query()` and `upload()` both run the query through the validator before
+        // sending; `batch()` did not, so a batch was the one way to bypass the
+        // length, depth and injection limits the module applies everywhere else.
+        for (const req of requests) {
+            validateGraphQLQuery(req.query);
+        }
         const headers = await buildHeaders(this.config);
         const controller = new AbortController();
         // Listener removed when the fetch settles — avoids accumulating on the
@@ -707,13 +797,38 @@ export class GraphQLClient {
         finally {
             options.signal?.removeEventListener("abort", onExternalAbort);
         }
-        // FIX (H6): sanitize untrusted batch response JSON before validation.
-        const rawResults = sanitizeParsedJSON(await response.json());
+        // Every other path routes a non-JSON body through `parseGraphQLResponse`,
+        // which turns it into a typed `EPARSE` / `ENETWORK` GraphQLClientError.
+        // `batch()` called `response.json()` bare, so a 502 HTML error page threw a
+        // raw `SyntaxError` with no `code` at all — a caller switching on
+        // `err.code` got `undefined` and had no way to tell this from a bug.
+        const ct = response.headers.get("content-type") ?? "";
+        if (!response.ok && !ct.includes("application/json")) {
+            const text = await response.text().catch(() => "(unreadable)");
+            throw new GraphQLClientError(`HTTP ${response.status}: ${response.statusText}\n${text}`, "ENETWORK", undefined, requests[0], undefined, new Error(`HTTP ${response.status}`));
+        }
+        let rawResults;
+        try {
+            // FIX (H6): sanitize untrusted batch response JSON before validation.
+            rawResults = sanitizeParsedJSON((await response.json()));
+        }
+        catch (err) {
+            throw new GraphQLClientError("Failed to parse batch response as JSON", "EPARSE", undefined, requests[0], undefined, err);
+        }
         // Validate response is array (B-5 fix)
         if (!Array.isArray(rawResults)) {
             throw new GraphQLClientError("Batch response must be an array of GraphQL responses", "EINVALIDRESPONSE", undefined, requests[0], rawResults);
         }
         const results = rawResults;
+        // The contract is "one `data` per request, in order". A server returning a
+        // different number was mapped over anyway: two requests answered with one
+        // result silently returned one item, and one request answered with three
+        // returned three — with `requests[i]` `undefined` for the extra ones, so an
+        // `errors` entry there was attributed to no request at all. Positional
+        // alignment is the whole point of a batch, so a mismatch is an error.
+        if (results.length !== requests.length) {
+            throw new GraphQLClientError(`Batch response has ${results.length} result(s) but ${requests.length} request(s) were sent`, "EINVALIDRESPONSE", undefined, requests[0], rawResults);
+        }
         return results.map((res, i) => {
             if (res.errors?.length)
                 throw buildGraphQLError(res.errors, requests[i], res);
@@ -776,7 +891,7 @@ export class GraphQLClient {
             ...(variables !== undefined ? { variables } : {}),
             ...(options.operationName !== undefined
                 ? { operationName: options.operationName }
-                : extractOperationName(query) !== undefined
+                : extractOperationName(query) !== null
                     ? { operationName: extractOperationName(query) }
                     : {}),
         };
@@ -861,6 +976,13 @@ export class GraphQLClient {
         });
     }
     async _executeWithRetry(req, signal) {
+        // A negative count made the loop condition false on the first evaluation,
+        // so the body never ran, `lastErr` was never assigned, and the method
+        // ended in `throw undefined` — a rejection carrying no value at all, so
+        // `err.message` threw a TypeError inside the caller's own error handler.
+        if (!Number.isInteger(this.config.retries) || this.config.retries < 0) {
+            throw new RangeError(`retries must be a non-negative integer, got ${this.config.retries}`);
+        }
         let lastErr;
         for (let attempt = 0; attempt <= this.config.retries; attempt++) {
             if (attempt > 0)
@@ -878,18 +1000,18 @@ export class GraphQLClient {
         }
         throw lastErr;
     }
-    async _executeWithAPQ(req, signal) {
-        if (!this.config.enableAPQ) {
-            return executeHTTP(req, this.config, signal, "none", undefined);
+    async _executeWithAPQ(req, signal, config = this.config) {
+        if (!config.enableAPQ) {
+            return executeHTTP(req, config, signal, "none", undefined);
         }
         // APQ: first try without query string
-        const res1 = await executeHTTP(req, this.config, signal, "omitQuery", (q) => this._getAPQHash(q));
+        const res1 = await executeHTTP(req, config, signal, "omitQuery", (q) => this._getAPQHash(q));
         // Check if server responded with PersistedQueryNotFound
         const notFound = res1.errors?.some((e) => e.extensions?.["code"] === "PERSISTED_QUERY_NOT_FOUND");
         if (!notFound)
             return res1;
         // Retry with full query
-        return executeHTTP(req, this.config, signal, "full", (q) => this._getAPQHash(q));
+        return executeHTTP(req, config, signal, "full", (q) => this._getAPQHash(q));
     }
 }
 // ============================================================================
@@ -945,7 +1067,9 @@ export function errorLink(handler) {
         catch (err) {
             if (!(err instanceof GraphQLClientError))
                 throw err;
-            const result = handler(err, op, () => next(op));
+            // Must be awaited: an async handler returning `null` — the documented
+            // way to say "re-throw" — would otherwise be a truthy Promise here.
+            const result = await handler(err, op, () => next(op));
             if (result)
                 return result;
             throw err;
@@ -997,6 +1121,13 @@ export function loggingLink(logger = (msg, data) => console.log(msg, data)) {
 export function retryLink(options = {}) {
     const max = options.maxRetries ?? 3;
     const delay = options.delayMs ?? 300;
+    // Same `throw undefined` defect as the client's own `retries`.
+    if (!Number.isInteger(max) || max < 0) {
+        throw new RangeError(`retryLink: maxRetries must be a non-negative integer, got ${max}`);
+    }
+    if (!Number.isFinite(delay) || delay < 0) {
+        throw new RangeError(`retryLink: delayMs must be a non-negative number, got ${delay}`);
+    }
     const should = options.shouldRetry ?? ((err) => !(err instanceof GraphQLClientError && err.isGraphQLError));
     return async (op, next) => {
         let lastErr;