Merge pull request #2 from rudy-on-rails/rudy-on-rails/sanitize-strin…

…g-inputs Sanitize double quoting strings inside of strings
rudy-on-rails · Jan 20, 2021 · 099aec5 · 099aec5
2 parents 5eea46c + 212a6d1
commit 099aec5
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 1 deletion.
diff --git a/core/src/main/kotlin/me/lazmaid/kraph/lang/GraphQLNode.kt b/core/src/main/kotlin/me/lazmaid/kraph/lang/GraphQLNode.kt
@@ -27,7 +27,7 @@ internal abstract class GraphQLNode {
     @Suppress("UNCHECKED_CAST")
     private fun convertToDataEntry(value: Any?) =
             when(value) {
-                is String   -> DataEntry.StringData(value)
+                is String   -> DataEntry.StringData(value.escapeQuotes())
                 is Int      -> DataEntry.NonDecimalNumberData(value.toLong())
                 is Long     -> DataEntry.NonDecimalNumberData(value)
                 is Float    -> DataEntry.DecimalNumberData(value.toDouble())
@@ -42,6 +42,10 @@ internal abstract class GraphQLNode {
             }
 }
 
+internal fun String.escapeQuotes() =
+    this.replace("\\s+".toRegex(), " ")
+        .replace("\"", "\\\\\\\"")
+
 internal fun String.wrappedWithQuotes(shouldBeEscaped: Boolean) =
         if (shouldBeEscaped) {
             "\"$this\""

diff --git a/core/src/test/kotlin/me/lazmaid/kraph/test/BuilderSpek.kt b/core/src/test/kotlin/me/lazmaid/kraph/test/BuilderSpek.kt
@@ -322,6 +322,21 @@ class BuilderSpek : Spek({
                 }
             }
         }
+
+        given("sample mutation with unescaped characters") {
+            val query = Kraph {
+                mutation {
+                    field("someField",
+                        args = mapOf(
+                            "foo" to "some \"bar\" over"
+                        )
+                    )
+                }
+            }
+            it("should escape those characters") {
+                assertThat(query.toRequestString(), equalTo("{\"query\": \"mutation { someField (foo: \\\"some \\\\\\\"bar\\\\\\\" over\\\") }\", \"variables\": null, \"operationName\": null}"))
+            }
+        }
     }
 })