Validation/coercion of input variables violates the GraphQL spec
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- graphql, python
- Domain
- api, backend-api-design
Research direction
The issue points to coerce_variable_values in src/graphql/execution/values.py and graphql-core's execute() entry point. Read that function and its callers first; done means invalid variable_values cause GraphQLError to be raised as a request error, with no data entry in the response.
Written by the indexing model from the issue text.
Description
When callling graphql-core's execute() function with variable_values which do not pass validation -- for example, including an unexpected key in the variable_values dictionary -- the current behavior is that an ExecutionResult object is returned from the function, with the associated GraphQLError present inside it. Instead, this should be treated as a Request error, according to the spec, meaning that a GraphQLError should be raised from execute().
The GraphQL spec states:
Request errors
Request errors are raised before execution begins. This may occur due to a parse grammar or validation error in the requested document, an inability to determine which operation to execute, or invalid input values for variables.
This means that it is incorrect for the coerce_variable_values function to be returning a GraphQLError inside an ExecutionResult: https://github.com/graphql-python/graphql-core/blob/9dcf25e66f6ed36b77de788621cf50bab600d1d3/src/graphql/execution/values.py#L93-L99
doing so means that a response payload is returned containing both an "errors" key and a null "data" key. Again, this a violation of the spec:
If a request error is raised, execution does not begin and the data entry in the response must not be present. The errors entry must include the error.
- Dominant language
- Python
- Stars
- 531
- Forks
- 147
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from graphql-python/graphql-core
-
Difficulty 4/5 3-5 days Newbie friendliness 50/100
graphql-python/graphql-core#272 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
graphql-python/graphql-core#269 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
graphql-python/graphql-core#267 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
graphql-python/graphql-core#257 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
graphql-python/graphql-core#247 · 8 comments ·
All issues in graphql-python/graphql-core
Similar issues
-
essnmx good first issue
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
[Feature] 奇物选择添加优先级 Open
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
syfoud/Simulated_Scepter#174 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Giskard-AI/giskard-oss#2840 · 1 comment ·
-
A claim comment carrying the issue number is silently declined while the workflow reports success Openarea: repo bug perceived difficulty: 2
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
yeti-platform/yeti#1380 ·