Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disallow empty GraphQLBatchRequests #639

Closed
tyranron opened this issue Apr 27, 2020 · 1 comment · Fixed by #644
Closed

Disallow empty GraphQLBatchRequests #639

tyranron opened this issue Apr 27, 2020 · 1 comment · Fixed by #644
Labels
enhancement Improvement of existing features or bugfix

Comments

@tyranron
Copy link
Member

Is your feature request related to a problem? Please describe.
At the moment, it's possible to deserialize GraphQLBatchRequest as an empty Vec<GraphQLRequest>. The downstream implementations (like juniper_warp) rely transparently on that, executing empty batch and returning empty response.

I'm unsure this is OK. Maybe, it's better to reject empty batches at deserialization level?

Describe the solution you'd like
The one was implemented once in early juniper_actix iterations:

enum GraphQLBatchRequest<S = DefaultScalarValue>
where
    S: ScalarValue,
{
    Single(GraphQLRequest<S>),
    #[serde(deserialize_with = "deserialize_non_empty_vec")]
    Batch(Vec<GraphQLRequest<S>>),
}

fn deserialize_non_empty_vec<'de, D, T>(
    deserializer: D,
) -> Result<Vec<T>, D::Error>
where
    D: de::Deserializer<'de>,
    T: Deserialize<'de>,
{
    let v = Vec::<T>::deserialize(deserializer)?;
    if v.is_empty() {
        Err(de::Error::invalid_length(0, &"a positive integer"))
    } else {
        Ok(v)
    }
}

Describe alternatives you've considered
Leave it "as is". But seems to be more error-prone for frontends.


If it something desirable, I'll submit the PR shortly.

@tyranron tyranron added the enhancement Improvement of existing features or bugfix label Apr 27, 2020
@LegNeato
Copy link
Member

Yeah, I think we should reject empty batch requests as it almost certainly points to a bug on the client side.

LegNeato pushed a commit that referenced this issue Apr 30, 2020
* Disallow deserialize empty GraphQLBatchRequest (#639)

* Add test for empty batch request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Improvement of existing features or bugfix
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants