Investigate whether example code handles file validation properly
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start with src/Plugin/GraphQL/Mutations/FileUpload.php and compare its file-validation logic with the change described in the Drupal GraphQL 8.x-4.2 security release. Determine whether the GraphQL 3.x example can encounter the invalid file-reference issue, then document the verification result and any required follow-up.
Written by the indexing model from the issue text.
Description
After the GraphQL 4.2 security release at https://www.drupal.org/project/graphql/releases/8.x-4.2 the file validation code was changed to fix an invalid file reference during validation. It appears that the example https://github.com/drupal-graphql/graphql-examples/blob/master/src/Plugin/GraphQL/Mutations/FileUpload.php for GraphQL 3.x uses a different logic and is not vulnerable, but please double check that.
Thanks!
- Dominant language
- PHP
- Stars
- 12
- Forks
- 6
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from drupal-graphql/graphql-examples
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
drupal-graphql/graphql-examples#6 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 30/100
All issues in drupal-graphql/graphql-examples
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
Do not throw `WordPress.Security.EscapeOutput.OutputNotEscaped` on `apply_shortcodes()`Possibly taken @tbradsha claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
fe: spell out "Auto increment" in the table editor, "AI" reads as artificial intelligence todayOpen
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
landsman/adminer-desktop#120 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
components-web-app/docs#227 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100