-
-
Notifications
You must be signed in to change notification settings - Fork 562
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #131 from n1ru4l/feature-disable-introspection-val…
…idation-rule Add DisableIntrospection validation rule
- Loading branch information
Showing
4 changed files
with
198 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,50 @@ | ||
<?php | ||
namespace GraphQL\Validator\Rules; | ||
|
||
use GraphQL\Error\Error; | ||
use GraphQL\Language\AST\FieldNode; | ||
use GraphQL\Language\AST\NodeKind; | ||
use GraphQL\Validator\ValidationContext; | ||
|
||
class DisableIntrospection extends AbstractQuerySecurity | ||
{ | ||
const ENABLED = 1; | ||
private $isEnabled; | ||
|
||
public function __construct($enabled) | ||
{ | ||
$this->setEnabled($enabled); | ||
} | ||
|
||
public function setEnabled($enabled) | ||
{ | ||
$this->isEnabled = $enabled; | ||
} | ||
|
||
static function introspectionDisabledMessage() | ||
{ | ||
return 'GraphQL introspection is not allowed, but the query contained __schema or __type'; | ||
} | ||
|
||
protected function isEnabled() | ||
{ | ||
return $this->isEnabled !== static::DISABLED; | ||
} | ||
|
||
public function __invoke(ValidationContext $context) | ||
{ | ||
return $this->invokeIfNeeded( | ||
$context, | ||
[ | ||
NodeKind::FIELD => function (FieldNode $node) use ($context) { | ||
if ($node->name->value === '__type' || $node->name->value === '__schema') { | ||
$context->reportError(new Error( | ||
static::introspectionDisabledMessage(), | ||
[$node] | ||
)); | ||
} | ||
} | ||
] | ||
); | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,128 @@ | ||
<?php | ||
namespace GraphQL\Tests\Validator; | ||
|
||
use GraphQL\Error\FormattedError; | ||
use GraphQL\Language\SourceLocation; | ||
use GraphQL\Validator\Rules\DisableIntrospection; | ||
|
||
class DisableIntrospectionTest extends TestCase | ||
{ | ||
// Validate: Disable Introspection | ||
|
||
/** | ||
* @it fails if the query contains __schema | ||
*/ | ||
public function testQueryContainsSchema() | ||
{ | ||
$this->expectFailsRule(new DisableIntrospection(DisableIntrospection::ENABLED), ' | ||
query { | ||
__schema { | ||
queryType { | ||
name | ||
} | ||
} | ||
} | ||
', | ||
[$this->error(3, 9)] | ||
); | ||
} | ||
|
||
/** | ||
* @it fails if the query contains __type | ||
*/ | ||
public function testQueryContainsType() | ||
{ | ||
$this->expectFailsRule(new DisableIntrospection(DisableIntrospection::ENABLED), ' | ||
query { | ||
__type( | ||
name: "Query" | ||
){ | ||
name | ||
} | ||
} | ||
', | ||
[$this->error(3, 9)] | ||
); | ||
} | ||
|
||
/** | ||
* @it does not fail on a query that does not contain __type | ||
*/ | ||
public function testValidQuery() | ||
{ | ||
$this->expectPassesRule(new DisableIntrospection(DisableIntrospection::ENABLED), ' | ||
query { | ||
user { | ||
name | ||
friends { | ||
name | ||
} | ||
} | ||
} | ||
'); | ||
} | ||
|
||
/** | ||
* @it does not fail when not enabled | ||
*/ | ||
public function testQueryWhenDisabled() | ||
{ | ||
$this->expectPassesRule(new DisableIntrospection(DisableIntrospection::DISABLED), ' | ||
query { | ||
__type( | ||
name: "Query" | ||
){ | ||
name | ||
} | ||
} | ||
'); | ||
} | ||
|
||
/** | ||
* @it has a public interface for enabeling the rule | ||
*/ | ||
public function testPublicEnableInterface() | ||
{ | ||
$disableIntrospection = new DisableIntrospection(DisableIntrospection::DISABLED); | ||
$disableIntrospection->setEnabled(DisableIntrospection::ENABLED); | ||
$this->expectFailsRule($disableIntrospection, ' | ||
query { | ||
__type( | ||
name: "Query" | ||
){ | ||
name | ||
} | ||
} | ||
', | ||
[$this->error(3, 9)] | ||
); | ||
} | ||
|
||
/** | ||
* @it has a public interface for disableing the rule | ||
*/ | ||
public function testPublicDisableInterface() | ||
{ | ||
$disableIntrospection = new DisableIntrospection(DisableIntrospection::ENABLED); | ||
$disableIntrospection->setEnabled(DisableIntrospection::DISABLED); | ||
$this->expectPassesRule($disableIntrospection, ' | ||
query { | ||
__type( | ||
name: "Query" | ||
){ | ||
name | ||
} | ||
} | ||
'); | ||
} | ||
|
||
|
||
private function error($line, $column) | ||
{ | ||
return FormattedError::create( | ||
DisableIntrospection::introspectionDisabledMessage(), | ||
[ new SourceLocation($line, $column) ] | ||
); | ||
} | ||
} |