Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upload inputs not being properly validated #3567

Open
Nnonexistent opened this issue Jul 11, 2024 · 0 comments
Open

Upload inputs not being properly validated #3567

Nnonexistent opened this issue Jul 11, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@Nnonexistent
Copy link

Nnonexistent commented Jul 11, 2024

If a client provides invalid input for the Upload field (e.g. string or number), strawberry don't raise any errors and executes the related resolver.

Describe the Bug

@strawberry.type
class Mutation:
    @strawberry.mutation
    def mutation(self, file: Upload) -> bool:
        return True
mutation { mutation (value: "just-a-string") }

If client will provide invalid input for the Upload field for such a mutation, the mutation will be executed without any errors.

Test that shows the issue

Ordinary fields are validated fine, but Upload fields are not validated

import pytest
from pytest_mock import MockerFixture
from starlette.testclient import TestClient

import strawberry
from strawberry.file_uploads import Upload
from tests.fastapi.app import create_app


@strawberry.type
class Query:
    empty: None = None


@strawberry.input
class SimpleInput:
    value: bool


@strawberry.input
class UploadInput:
    value: Upload


@pytest.mark.parametrize(
    ("input_value_annotation", "graphql_type", "bad_variable"),
    [
        (bool, "Boolean", "not a boolean"),
        (SimpleInput, "SimpleInput", "just a string"),
        (SimpleInput, "SimpleInput", {"value": "not a boolean"}),
        (UploadInput, "UploadInput", "just a string"),
        (UploadInput, "UploadInput", {"value": "not an upload"}),  # this is currently failing
        (Upload, "Upload", "not an upload"),  # this is currently failing
    ],
)
async def test_mutation_input_validation(
    mocker: MockerFixture, input_value_annotation, graphql_type, bad_variable
):
    mock = mocker.Mock()

    def resolver(value) -> bool:
        mock()
        return True

    # dynamic addition of input field annotation:
    resolver.__annotations__ = {"value": input_value_annotation}

    @strawberry.type
    class Mutation:
        mutation = strawberry.mutation(resolver, graphql_type=bool)

    app = create_app(schema=strawberry.Schema(Query, mutation=Mutation))

    response = TestClient(app).post(
        "/graphql",
        json={
            "query": f"mutation($value: {graphql_type}!) {{ mutation(value: $value) }}",
            "variables": {"value": bad_variable},
        },
    )

    response_json = response.json()
    assert mock.call_count == 0
    assert response_json["data"] is None
    assert response_json["errors"] is not None

System Information

  • Operating system: Linux
  • Strawberry version (if applicable): 0.235.2

Additional Context

Upvote & Fund

  • We're using Polar.sh so you can upvote and help fund this issue.
  • We receive the funding once the issue is completed & confirmed by you.
  • Thank you in advance for helping prioritize & fund our backlog.
Fund with Polar
@Nnonexistent Nnonexistent added the bug Something isn't working label Jul 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant