strawberry-graphql/strawberry

AttributeError when query passed is a list and not a dict

Amangiri99 opened this issue · 6 comments

Amangiri99 commented

While doing a testing my graphql endpoints, I came across an issue that if the query sent in the request is a list an attributeError is raised.
On further investigation I found out when parsing the request data to GrahpqlRequestData we are accessing the data assuming it's a dict, rather we should validate it first if data is a valid dictionary

Describe the Bug

System Information

  • Operating system: MacOS
  • Strawberry version (if applicable): 0.219.2

Additional Context

Upvote & Fund

  • We're using Polar.sh so you can upvote and help fund this issue.
  • We receive the funding once the issue is completed & confirmed by you.
  • Thank you in advance for helping prioritize & fund our backlog.
Fund with Polar
patrick91 commented

Hi @Amangiri99 can you add a reproduction? 😊 thanks!

Amangiri99 commented

Hit any of the graphql endpoints, by sending a query. The query shouldn't be a dict rather a list.
Example: --data “[{\”query":"{something(id:\"examples\"){getSomething{Some}}}\”}]” \

Also I got this error while making request using curl command.

patrick91 commented

@Amangiri99 how come you're sending a list? usually that's done when you want to run multiple operations (like batching)

Amangiri99 commented

@patrick91 It's just a random error, that I came across while doing a peneration testing of my application. Also we won't be able to send a list from postman or graphql ide. This can only be sent using curl request

patrick91 commented

@Amangiri99 yeah, but you could send a list using things like https://www.apollographql.com/docs/react/api/link/apollo-link-batch-http/

I don't think we should worry about lists with single items for now (batching will help with that), but maybe we can improve the error?

Amangiri99 commented

@patrick91 Right, we should improve the error. We should send a generic error if a list is received instead of object.