Skip to content

Commit 5ccedd7

Browse files
trevor-scheertrevor-scheer
authored
feat(audits/server) Check variable coercion failure (#58)
Closes #57 Co-authored-by: enisdenjo <badurinadenis@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent b701ea3 commit 5ccedd7

File tree

22 files changed

+379
-54
lines changed

22 files changed

+379
-54
lines changed

‎implementations/apollo-server/README.md

+78-3
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
<h1>GraphQL over HTTP audit report</h1>
44

55
<ul>
6-
<li><b>78</b> audits in total</li>
7-
<li><span style="font-family: monospace">✅</span> <b>53</b> pass</li>
8-
<li><span style="font-family: monospace">⚠️</span> <b>25</b> warnings (optional)</li>
6+
<li><b>80</b> audits in total</li>
7+
<li><span style="font-family: monospace">✅</span> <b>54</b> pass</li>
8+
<li><span style="font-family: monospace">⚠️</span> <b>26</b> warnings (optional)</li>
99
</ul>
1010

1111
<h2>Passing</h2>
@@ -63,6 +63,7 @@
6363
<li><code>51FE</code> SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json</li>
6464
<li><code>74FF</code> SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json</li>
6565
<li><code>5E5B</code> SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json</li>
66+
<li><code>86EE</code> SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json</li>
6667
</ol>
6768

6869
<h2>Warnings</h2>
@@ -1037,5 +1038,79 @@ The server <i>SHOULD</i> support these, but is not required.
10371038
</code></pre>
10381039
</details>
10391040
</li>
1041+
<li><code>7B9B</code> SHOULD use a status code of 200 on variable coercion failure when accepting application/json
1042+
<details>
1043+
<summary>Response status code is not 200</summary>
1044+
<pre><code class="lang-json">{
1045+
"statusText": "Bad Request",
1046+
"status": 400,
1047+
"headers": {
1048+
"x-powered-by": "Express",
1049+
"etag": "W/\"bb6-gXaURMU/HGIiPsrBiHj0x/xi2Cw\"",
1050+
"date": "<timestamp>",
1051+
"content-type": "application/json; charset=utf-8",
1052+
"content-length": "2998",
1053+
"connection": "close",
1054+
"cache-control": "no-store",
1055+
"access-control-allow-origin": "*"
1056+
},
1057+
"body": {
1058+
"errors": [
1059+
{
1060+
"message": "Unknown type \"ID\".",
1061+
"locations": [
1062+
{
1063+
"line": 1,
1064+
"column": 26
1065+
}
1066+
],
1067+
"extensions": {
1068+
"stacktrace": [
1069+
"GraphQLError: Unknown type \"ID\".",
1070+
" at Object.NamedType (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/validation/rules/KnownTypeNamesRule.js:65:11)",
1071+
" at Object.enter (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/visitor.js:301:32)",
1072+
" at Object.enter (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/utilities/TypeInfo.js:391:27)",
1073+
" at visit (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/visitor.js:197:21)",
1074+
" at validate (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/validation/validate.js:91:24)",
1075+
" at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:97:34)",
1076+
" at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
1077+
" at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)",
1078+
" at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)",
1079+
" at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)"
1080+
],
1081+
"code": "GRAPHQL_VALIDATION_FAILED"
1082+
}
1083+
},
1084+
{
1085+
"message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
1086+
"locations": [
1087+
{
1088+
"line": 1,
1089+
"column": 21
1090+
}
1091+
],
1092+
"extensions": {
1093+
"stacktrace": [
1094+
"GraphQLError: Variable \"$id\" is never used in operation \"CoerceFailure\".",
1095+
" at Object.leave (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/validation/rules/NoUnusedVariablesRule.js:39:15)",
1096+
" at Object.leave (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/visitor.js:324:32)",
1097+
" at Object.leave (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/utilities/TypeInfo.js:411:21)",
1098+
" at visit (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/language/visitor.js:197:21)",
1099+
" at validate (/home/runner/work/graphql-http/graphql-http/node_modules/graphql/validation/validate.js:91:24)",
1100+
" at processGraphQLRequest (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/requestPipeline.js:97:34)",
1101+
" at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
1102+
" at async internalExecuteOperation (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/ApolloServer.js:585:16)",
1103+
" at async runHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/runHttpQuery.js:129:29)",
1104+
" at async runPotentiallyBatchedHttpQuery (file:///home/runner/work/graphql-http/graphql-http/node_modules/@apollo/server/dist/esm/httpBatching.js:34:16)"
1105+
],
1106+
"code": "GRAPHQL_VALIDATION_FAILED"
1107+
}
1108+
}
1109+
]
1110+
}
1111+
}
1112+
</code></pre>
1113+
</details>
1114+
</li>
10401115
</ol>
10411116

‎implementations/apollo-server/report.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"total": 78,
3-
"ok": 53,
4-
"warn": 25,
2+
"total": 80,
3+
"ok": 54,
4+
"warn": 26,
55
"error": 0
66
}

‎implementations/deno/README.md

+21-3
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
<h1>GraphQL over HTTP audit report</h1>
44

55
<ul>
6-
<li><b>78</b> audits in total</li>
7-
<li><span style="font-family: monospace">✅</span> <b>35</b> pass</li>
8-
<li><span style="font-family: monospace">⚠️</span> <b>43</b> warnings (optional)</li>
6+
<li><b>80</b> audits in total</li>
7+
<li><span style="font-family: monospace">✅</span> <b>36</b> pass</li>
8+
<li><span style="font-family: monospace">⚠️</span> <b>44</b> warnings (optional)</li>
99
</ul>
1010

1111
<h2>Passing</h2>
@@ -41,6 +41,7 @@
4141
<li><code>F5AF</code> SHOULD use 200 status code if parameters are invalid when accepting application/json</li>
4242
<li><code>572B</code> SHOULD use 200 status code on document parsing failure when accepting application/json</li>
4343
<li><code>FDE2</code> SHOULD use 200 status code on document validation failure when accepting application/json</li>
44+
<li><code>7B9B</code> SHOULD use a status code of 200 on variable coercion failure when accepting application/json</li>
4445
<li><code>60AA</code> SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json</li>
4546
<li><code>3E36</code> SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json</li>
4647
<li><code>865D</code> SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json</li>
@@ -823,5 +824,22 @@ The server <i>SHOULD</i> support these, but is not required.
823824
</code></pre>
824825
</details>
825826
</li>
827+
<li><code>86EE</code> SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json
828+
<details>
829+
<summary>Response status code is not 400</summary>
830+
<pre><code class="lang-json">{
831+
"statusText": "Not Acceptable",
832+
"status": 406,
833+
"headers": {
834+
"vary": "Accept-Encoding",
835+
"date": "<timestamp>",
836+
"content-type": "text/plain;charset=UTF-8",
837+
"content-length": "14"
838+
},
839+
"body": "Not Acceptable"
840+
}
841+
</code></pre>
842+
</details>
843+
</li>
826844
</ol>
827845

‎implementations/deno/report.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"total": 78,
3-
"ok": 35,
4-
"warn": 43,
2+
"total": 80,
3+
"ok": 36,
4+
"warn": 44,
55
"error": 0
66
}

‎implementations/express-graphql/README.md

+44-3
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
<h1>GraphQL over HTTP audit report</h1>
44

55
<ul>
6-
<li><b>78</b> audits in total</li>
7-
<li><span style="font-family: monospace">✅</span> <b>45</b> pass</li>
8-
<li><span style="font-family: monospace">⚠️</span> <b>33</b> warnings (optional)</li>
6+
<li><b>80</b> audits in total</li>
7+
<li><span style="font-family: monospace">✅</span> <b>46</b> pass</li>
8+
<li><span style="font-family: monospace">⚠️</span> <b>34</b> warnings (optional)</li>
99
</ul>
1010

1111
<h2>Passing</h2>
@@ -55,6 +55,7 @@
5555
<li><code>51FE</code> SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json</li>
5656
<li><code>74FF</code> SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json</li>
5757
<li><code>5E5B</code> SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json</li>
58+
<li><code>86EE</code> SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json</li>
5859
</ol>
5960

6061
<h2>Warnings</h2>
@@ -851,5 +852,45 @@ The server <i>SHOULD</i> support these, but is not required.
851852
</code></pre>
852853
</details>
853854
</li>
855+
<li><code>7B9B</code> SHOULD use a status code of 200 on variable coercion failure when accepting application/json
856+
<details>
857+
<summary>Response status code is not 200</summary>
858+
<pre><code class="lang-json">{
859+
"statusText": "Bad Request",
860+
"status": 400,
861+
"headers": {
862+
"x-powered-by": "Express",
863+
"etag": "W/\"c6-jKvd+KIdPY2/2i/wYj0ck5PZF20\"",
864+
"date": "<timestamp>",
865+
"content-type": "application/json; charset=utf-8",
866+
"content-length": "198",
867+
"connection": "close"
868+
},
869+
"body": {
870+
"errors": [
871+
{
872+
"message": "Unknown type \"ID\".",
873+
"locations": [
874+
{
875+
"line": 1,
876+
"column": 26
877+
}
878+
]
879+
},
880+
{
881+
"message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
882+
"locations": [
883+
{
884+
"line": 1,
885+
"column": 21
886+
}
887+
]
888+
}
889+
]
890+
}
891+
}
892+
</code></pre>
893+
</details>
894+
</li>
854895
</ol>
855896

‎implementations/express-graphql/report.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"total": 78,
3-
"ok": 45,
4-
"warn": 33,
2+
"total": 80,
3+
"ok": 46,
4+
"warn": 34,
55
"error": 0
66
}

‎implementations/graph-client/README.md

+4-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
<h1>GraphQL over HTTP audit report</h1>
44

55
<ul>
6-
<li><b>78</b> audits in total</li>
7-
<li><span style="font-family: monospace">✅</span> <b>78</b> pass</li>
6+
<li><b>80</b> audits in total</li>
7+
<li><span style="font-family: monospace">✅</span> <b>80</b> pass</li>
88
</ul>
99

1010
<h2>Passing</h2>
@@ -76,6 +76,7 @@
7676
<li><code>F5AF</code> SHOULD use 200 status code if parameters are invalid when accepting application/json</li>
7777
<li><code>572B</code> SHOULD use 200 status code on document parsing failure when accepting application/json</li>
7878
<li><code>FDE2</code> SHOULD use 200 status code on document validation failure when accepting application/json</li>
79+
<li><code>7B9B</code> SHOULD use a status code of 200 on variable coercion failure when accepting application/json</li>
7980
<li><code>60AA</code> SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json</li>
8081
<li><code>2163</code> SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json</li>
8182
<li><code>3E36</code> SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json</li>
@@ -87,5 +88,6 @@
8788
<li><code>51FE</code> SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json</li>
8889
<li><code>74FF</code> SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json</li>
8990
<li><code>5E5B</code> SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json</li>
91+
<li><code>86EE</code> SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json</li>
9092
</ol>
9193

‎implementations/graph-client/report.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"total": 78,
3-
"ok": 78,
2+
"total": 80,
3+
"ok": 80,
44
"warn": 0,
55
"error": 0
66
}

‎implementations/graphql-helix/README.md

+43-3
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
<h1>GraphQL over HTTP audit report</h1>
44

55
<ul>
6-
<li><b>78</b> audits in total</li>
7-
<li><span style="font-family: monospace">✅</span> <b>49</b> pass</li>
8-
<li><span style="font-family: monospace">⚠️</span> <b>29</b> warnings (optional)</li>
6+
<li><b>80</b> audits in total</li>
7+
<li><span style="font-family: monospace">✅</span> <b>50</b> pass</li>
8+
<li><span style="font-family: monospace">⚠️</span> <b>30</b> warnings (optional)</li>
99
</ul>
1010

1111
<h2>Passing</h2>
@@ -59,6 +59,7 @@
5959
<li><code>51FE</code> SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json</li>
6060
<li><code>74FF</code> SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json</li>
6161
<li><code>5E5B</code> SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json</li>
62+
<li><code>86EE</code> SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json</li>
6263
</ol>
6364

6465
<h2>Warnings</h2>
@@ -730,5 +731,44 @@ The server <i>SHOULD</i> support these, but is not required.
730731
</code></pre>
731732
</details>
732733
</li>
734+
<li><code>7B9B</code> SHOULD use a status code of 200 on variable coercion failure when accepting application/json
735+
<details>
736+
<summary>Response status code is not 200</summary>
737+
<pre><code class="lang-json">{
738+
"statusText": "Bad Request",
739+
"status": 400,
740+
"headers": {
741+
"x-powered-by": "Express",
742+
"date": "<timestamp>",
743+
"content-type": "application/json",
744+
"content-length": "198",
745+
"connection": "close"
746+
},
747+
"body": {
748+
"errors": [
749+
{
750+
"message": "Unknown type \"ID\".",
751+
"locations": [
752+
{
753+
"line": 1,
754+
"column": 26
755+
}
756+
]
757+
},
758+
{
759+
"message": "Variable \"$id\" is never used in operation \"CoerceFailure\".",
760+
"locations": [
761+
{
762+
"line": 1,
763+
"column": 21
764+
}
765+
]
766+
}
767+
]
768+
}
769+
}
770+
</code></pre>
771+
</details>
772+
</li>
733773
</ol>
734774

‎implementations/graphql-helix/report.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"total": 78,
3-
"ok": 49,
4-
"warn": 29,
2+
"total": 80,
3+
"ok": 50,
4+
"warn": 30,
55
"error": 0
66
}

‎implementations/graphql-yoga/README.md

+4-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
<h1>GraphQL over HTTP audit report</h1>
44

55
<ul>
6-
<li><b>78</b> audits in total</li>
7-
<li><span style="font-family: monospace">✅</span> <b>78</b> pass</li>
6+
<li><b>80</b> audits in total</li>
7+
<li><span style="font-family: monospace">✅</span> <b>80</b> pass</li>
88
</ul>
99

1010
<h2>Passing</h2>
@@ -76,6 +76,7 @@
7676
<li><code>F5AF</code> SHOULD use 200 status code if parameters are invalid when accepting application/json</li>
7777
<li><code>572B</code> SHOULD use 200 status code on document parsing failure when accepting application/json</li>
7878
<li><code>FDE2</code> SHOULD use 200 status code on document validation failure when accepting application/json</li>
79+
<li><code>7B9B</code> SHOULD use a status code of 200 on variable coercion failure when accepting application/json</li>
7980
<li><code>60AA</code> SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json</li>
8081
<li><code>2163</code> SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json</li>
8182
<li><code>3E36</code> SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json</li>
@@ -87,5 +88,6 @@
8788
<li><code>51FE</code> SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json</li>
8889
<li><code>74FF</code> SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json</li>
8990
<li><code>5E5B</code> SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json</li>
91+
<li><code>86EE</code> SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json</li>
9092
</ol>
9193

‎implementations/graphql-yoga/report.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"total": 78,
3-
"ok": 78,
2+
"total": 80,
3+
"ok": 80,
44
"warn": 0,
55
"error": 0
66
}

0 commit comments

Comments
 (0)