diff --git a/cmd/api/src/queries/graph.go b/cmd/api/src/queries/graph.go index f525ce747d..b0e3b26fc9 100644 --- a/cmd/api/src/queries/graph.go +++ b/cmd/api/src/queries/graph.go @@ -367,6 +367,7 @@ type PreparedQuery struct { } func (s *GraphQuery) PrepareCypherQuery(rawCypher string) (PreparedQuery, error) { + var ( cypherFilters = []frontend.Visitor{ &frontend.ExplicitProcedureInvocationFilter{}, @@ -380,6 +381,8 @@ func (s *GraphQuery) PrepareCypherQuery(rawCypher string) (PreparedQuery, error) // If cypher mutations are disabled, we want to add the updating clause filter to properly error as unsupported query if !s.EnableCypherMutations { + cypherFilters = append(cypherFilters, &frontend.UpdatingNotAllowedClauseFilter{}) + } else { cypherFilters = append(cypherFilters, &frontend.UpdatingClauseFilter{}) } diff --git a/packages/go/cypher/frontend/filter.go b/packages/go/cypher/frontend/filter.go index 25fc0ebfed..9e2849a9f6 100644 --- a/packages/go/cypher/frontend/filter.go +++ b/packages/go/cypher/frontend/filter.go @@ -25,6 +25,7 @@ import ( // TODO: Review if relying on a deny model is less secure than explicit allow func DefaultCypherContext() *Context { return NewContext( + &UpdatingNotAllowedClauseFilter{}, &UpdatingClauseFilter{}, &ExplicitProcedureInvocationFilter{}, &ImplicitProcedureInvocationFilter{}, @@ -56,10 +57,18 @@ func (s *SpecifiedParametersFilter) EnterOC_Parameter(ctx *parser.OC_ParameterCo s.ctx.AddErrors(ErrUserSpecifiedParametersNotSupported) } +type UpdatingNotAllowedClauseFilter struct { + BaseVisitor +} + +func (s *UpdatingNotAllowedClauseFilter) EnterOC_UpdatingClause(ctx *parser.OC_UpdatingClauseContext) { + s.ctx.AddErrors(ErrUpdateClauseNotSupported) +} + type UpdatingClauseFilter struct { BaseVisitor } func (s *UpdatingClauseFilter) EnterOC_UpdatingClause(ctx *parser.OC_UpdatingClauseContext) { - s.ctx.AddErrors(ErrUpdateClauseNotSupported) + // Do something that marks this as an updating clause to check later (in pattern.go) }