Query Vars Types

Sydney-o9 · November 26, 2020, 10:51am

Hi Team,

I have noticed Dgraph does not have any type safety in place when it comes to the vars passed along to a query.

For example, in Slash, this:

Screen Shot 2020-11-26 at 9.46.10 pm

Will send the following to Dgraph backend:

Screen Shot 2020-11-26 at 9.47.47 pm

May I understand why that is?

May I suggest that we may it obvious on the client side that we don’t support different value types:

github.com

dgraph-io/dgraph-js-http/blob/master/src/txn.ts#L62


 */
public query(q: string, options?: { debug?: boolean }): Promise<Response> {
    return this.queryWithVars(q, undefined, options);
}

/**
 * queryWithVars is like query, but allows a variable map to be used. This can
 * provide safety against injection attacks.
 */
public async queryWithVars(
    q: string,
    vars?: { [k: string]: any }, // tslint:disable-line no-any
    options: { debug?: boolean } = {},
): Promise<Response> {
    if (this.finished) {
        this.dc.debug(`Query request (ERR_FINISHED):\nquery = ${q}\nvars = ${vars}`);
        throw ERR_FINISHED;
    }

    const req: Request = {
        query: q,

This surprise can be quite dangerous:

github.com

dgraph-io/dgraph-js-http/blob/master/src/txn.ts#L79


}

const req: Request = {
    query: q,
    startTs: this.ctx.start_ts,
    timeout: this.dc.getQueryTimeout(),
    debug: options.debug,
    readOnly: this.ctx.readOnly,
    bestEffort: this.ctx.bestEffort,
    hash: this.ctx.hash,
};
if (vars !== undefined) {
    const varsObj: { [k: string]: string } = {};
    Object.keys(vars).forEach((key: string) => {
        const value = vars[key];
        if (typeof value === "string" || value instanceof String) {
            varsObj[key] = value.toString();
        }
    });

    req.vars = varsObj;

See the conversion to a string…

I suggest we change the signature to vars?: { [k: string]: string }, and avoid converting to string on behalf of the user?

chewxy · November 30, 2020, 12:32am

This has been accepted as a ticket btw @Sydney-o9

Sydney-o9 · December 1, 2020, 10:03pm

Thank you @chewxy !