Query Vars Types

Sydney-o9 · November 26, 2020, 10:51am

Hi Team,

I have noticed Dgraph does not have any type safety in place when it comes to the vars passed along to a query.

For example, in Slash, this:

Screen Shot 2020-11-26 at 9.46.10 pm

Will send the following to Dgraph backend:

Screen Shot 2020-11-26 at 9.47.47 pm

May I understand why that is?

May I suggest that we may it obvious on the client side that we don’t support different value types:

github.com

dgraph-io/dgraph-js-http/blob/master/src/txn.ts#L62


      
           */
          public query(q: string, options?: { debug?: boolean }): Promise<Response> {
              return this.queryWithVars(q, undefined, options);
          }
          
          /**
           * queryWithVars is like query, but allows a variable map to be used. This can
           * provide safety against injection attacks.
           */
          public async queryWithVars(
              q: string,
              vars?: { [k: string]: any }, // tslint:disable-line no-any
              options: { debug?: boolean } = {},
          ): Promise<Response> {
              if (this.finished) {
                  this.dc.debug(`Query request (ERR_FINISHED):\nquery = ${q}\nvars = ${vars}`);
                  throw ERR_FINISHED;
              }
          
              const req: Request = {
                  query: q,

This surprise can be quite dangerous:

github.com

dgraph-io/dgraph-js-http/blob/master/src/txn.ts#L79


      
          }
          
          const req: Request = {
              query: q,
              startTs: this.ctx.start_ts,
              timeout: this.dc.getQueryTimeout(),
              debug: options.debug,
              readOnly: this.ctx.readOnly,
              bestEffort: this.ctx.bestEffort,
              hash: this.ctx.hash,
          };
          if (vars !== undefined) {
              const varsObj: { [k: string]: string } = {};
              Object.keys(vars).forEach((key: string) => {
                  const value = vars[key];
                  if (typeof value === "string" || value instanceof String) {
                      varsObj[key] = value.toString();
                  }
              });
          
              req.vars = varsObj;

See the conversion to a string…

I suggest we change the signature to vars?: { [k: string]: string }, and avoid converting to string on behalf of the user?

chewxy · November 30, 2020, 12:32am

This has been accepted as a ticket btw @Sydney-o9

Sydney-o9 · December 1, 2020, 10:03pm

Thank you @chewxy !

Topic		Replies	Views
[Question] Why can queryWithVars variables only be strings, not ints? Dgraph Clients kind:question , dgraph-js	3	479	July 11, 2020
Dgraph-js only accepts strings as query args Dgraph Clients	1	567	December 28, 2020
Fix queryWithVars to handle UTF-8 values correctly Issues dgraph-js-http , kind:enhancement	7	535	July 11, 2020
Predicate name support in GraphQL variables Dgraph dgraph , status:accepted , kind:feature , area:querylang:vars	6	987	September 15, 2022
Allow QueryWithVars with a list as argument instead of a map Dgraph Clients dgo , untagged	5	582	July 11, 2020

Query Vars Types

Related Topics