QueryWithVars using `after:` fails

[llonchj]

If you suspect this could be a bug, follow the template.

• What version of Dgraph are you using?

• Have you tried reproducing the issue with latest release?

• What is the hardware spec (RAM, OS)?

MacOS 10.13.3 16Gb

• Steps to reproduce the issue (command/config used to run Dgraph).

This is what i have

    items(func:has(<type:EmailAddress>), orderasc:<type:EmailAddress>, after:$i) @filter(regexp(<address>, /$var/)) {
        uid
        key: <type:EmailAddress>
    }
}```

and vars

```map[$var:@example\.com $i:0x1010]```

- Expected behaviour and actual result.

```rpc error: code = Unknown desc = Expecting a comma. Got: lex.Item [9] "i"```

[sboorlagadda]

It looks like GraphQL & Dgraph vars are not supported for after. If we set the actual value it works.

query q($var: string) {

	items(func:has(<type:EmailAddress>), orderasc:<type:EmailAddress>, after: 0x1010) @filter(regexp(<type:EmailAddress>, /$var/)) {
                uid
        	key: <type:EmailAddress>
    	}
}

But none of these below seem to work.

Dgraph Var

query q($var: string, $i: string) {
	var (func: uid($i)) {
		a as uid
	}
	items(func:has(<type:EmailAddress>), orderasc:<type:EmailAddress>, after: a) @filter(regexp(<type:EmailAddress>, /$var/)) {
        	uid
        	key: <type:EmailAddress>
    	}
}

GraphQL Var

query q($i: string) {
	me(func: has(friend), after: $i) {
		uid
		name
		friend {
			count(uid)
		}
	}
}

[pawanrawal]

Dgraph query uid/value variables don't make sense as being used for after. We should support GraphQL variables for after though.

[llonchj]

@sboorlagadda I agree, after and likely the other variables involved in a q(...) should be supported via graphql variables to avoid potential query injection vulnerabilities.

[pawanrawal]

Merged to master with e05f0fd.

[llonchj]

Thanks! Will test and give feedback El El mar, 27 feb 2018 a las 14:23, Pawan Rawal <notifications@github.com> escribió:

…

Closed #2099 <#2099>. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2099 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAVtPoj5mGVO7EdJ3vHqGB5tUzExYi-Rks5tY3VIgaJpZM4R8Ntt> .