-
Notifications
You must be signed in to change notification settings - Fork 434
Validate variables of the executed operation only #462
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Validate variables of the executed operation only #462
Conversation
Codecov Report
@@ Coverage Diff @@
## master #462 +/- ##
==========================================
- Coverage 85.73% 85.69% -0.04%
==========================================
Files 111 111
Lines 15960 15938 -22
==========================================
- Hits 13683 13658 -25
- Misses 2277 2280 +3
Continue to review full report at Codecov.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the change and detailed explanation! 🍻 . Two small things that I see.
Use `unreachable!` instead of `panic!` on invalid variable types, since thay have already been checked during document validation.
Thanks for the PR and the explanation! |
* Validate variables of the executed operation only * Use `unreachable!` in `validate_var_defs`. Use `unreachable!` instead of `panic!` on invalid variable types, since thay have already been checked during document validation. * Fix formatting in `validation/input_value.rs`
Fix for #455
This PR changes a larger number of files than expected. Here is the rationale.
execute_validated_query
. However, we need the result invalidate_input_values
which is called beforeexecute_validated_query
.get_operation
method (the naming mimics the GraphQL spec, see https://graphql.github.io/graphql-spec/June2018/#GetOperation() ), meant to be called directly fromexecute
. The resulting Operation can be then passed directly tovalidate_input_values
instead of the whole document.get_operation
code originally runs after the validation of the document, butvalidate_input_values
is run before this validation. Callingget_operation
before the validation of the document is dangerous, as it could impact the error reporting for invalid documents (say, multiple operations defined with the same name). I thought that it made much more sense to validate the document first, and then the input variables, so I made this change.does_not_allow_invalid_types_to_be_used_as_values
anddoes_not_allow_unknown_types_to_be_used_as_values
.