Upgrading graphql-playground-middleware-express.

[revanth0212]

Description

Fixes the graphql-playground-middleware-express security issue.

https://github.com/magento/pwa-studio/network/alert/yarn.lock/graphql-playground-html/open

Related Issue

Closes PWA-678

Acceptance

Gql Playground should work as expected and the GitHub security issue should be resolved.

Verification Stakeholders

@zetlen
@jimbo

Verification Steps

1. yarn watch:venia
2. Open the deployed graphiql app in the browser.
3. Should not fail when an operation is performed.

Checklist

None

[revanth0212]

@zetlen the security issue also suggests that we use a sanitizer to clean the endpoint before providing it to the playground middleware. We are not doing that in our current implementation of PWADevServer.js. Do you think I should add that as part of this PR?

Here is their suggestion:

const { expressPlayground } = require('graphql-playground-middleware-express');
const { sanitizeUrl } = require('@braintree/sanitize-url');

const qs = require('querystringify');

const { renderPlaygroundPage } = require('graphql-playground-html');

module.exports = (req, res, next) => {
	const { endpoint } = qs.parse(req.url)
	res.html(expressPlayground({endpoint: sanitizeUrl(endpoint) })).status(200)
	next()
}

[PWAStudioBot]

	Messages
📖	Access a deployed version of this PR here. Make sure to wait for the "pwa-pull-request-deploy" job to complete.
📖	DangerCI Failures related to missing labels/description/linked issues/etc will persist until the next push or next nightly build run (assuming they are fixed).
📖	Associated JIRA tickets: PWA-678.

Generated by 🚫 dangerJS against 5393553

[devops-pwa-codebuild]

Performance Test Results

The following fails have been reported by WebpageTest. These numbers indicates a possible performance issue with the PR which requires further manual testing to validate.

https://pr-2482.pwa-venia.com : LH Performance Expected 0.85 Actual 0.56, LH Best Practices Expected 1 Actual 0.92
https://pr-2482.pwa-venia.com/venia-tops.html : LH Performance Expected 0.75 Actual 0.34, LH Best Practices Expected 1 Actual 0.92
https://pr-2482.pwa-venia.com/valeria-two-layer-tank.html : LH Performance Expected 0.8 Actual 0.49, LH Accessibility Expected 0.9 Actual 0.89, LH Best Practices Expected 1 Actual 0.92

[sirugh]

It's a bummer that we can't just update this version everywhere since 1.7.12 is hardcoded in the last patch in v3 of graphql-cli. If they just used ~ then we could have updated this without resolutions!

[sirugh]

Approved! The only alternative I could see is upgrading to graphql-cli@4.0.0 but that's a major change and would require more time and attention.

[revanth0212]

Approved! The only alternative I could see is upgrading to graphql-cli@4.0.0 but that's a major change and would require more time and attention.

Yeah dude that would be a major change.