graphql-engine/server
Antoine Leblanc 52d91e3e8d Update GraphQL Parser version to fix text encoding issue (fix #1965)
### A long tale about encoding

GraphQL has an [introspection system](http://spec.graphql.org/June2018/#sec-Introspection), which allows its schema to be introspected. This is what we use to introspect [remote schemas](41383e1f88/server/src-rsr/introspection.json). There is one place in the introspection where we might find GraphQL values: the default value of an argument.

```json
{
  "fields": [
    {
      "name": "echo",
      "args": [
        {
          "name": "msg",
          "defaultValue": "\"Hello\\nWorld!\""
        }
      ]
    }
  ]
}
```

Note that GraphQL's introspection is transport agnostic: the default value isn't returned as a JSON value, but as a _string-encoded GraphQL Value_. In this case, the value is the GraphQL String `"Hello\nWorld!"`. Embedded into a string, it is encoded as: `"\"Hello\\nWorld!\""`.

When we [parse that value](41383e1f88/server/src-lib/Hasura/GraphQL/RemoteServer.hs (L351)), we first extract that JSON string, to get its content, `"Hello\nWorld!"`, then use our [GraphQL Parser library](21c1ddfb41/src/Language/GraphQL/Draft/Parser.hs (L200)) to interpret this: we find the double quote, understand that the content is a String, unescape the backslashes, and end up with the desired string value: `['H', 'e', 'l', 'l', 'o', '\n', 'W', 'o', 'r', 'l', 'd', '!']`. This all works fine.

However, there was a bug in the _printer_ part of our parser library: when printing back a String value, we would not re-escape characters properly. In practice, this meant that the GraphQL String `"Hello\nWorld"` would be encoded in JSON as `"\"Hello\nWorld!\""`. Note how the `\n` is not properly double-escaped. This led to a variety of problems, as described in #1965:
- we would successfully parse a remote schema containing such characters in its default values, but then would print those erroneous JSON values in our introspection, which would _crash the console_
- we would inject those default values in queries sent to remote schemas, and print them wrong doing so, sending invalid values to remote schemas and getting errors in result

It turns out that this bug had been lurking in the code for a long time: I combed through the history of [the parser library](https://github.com/hasura/graphql-parser-hs), and as far as I can tell, this bug has always been there. So why was it never caught? After all, we do have [round trip tests](21c1ddfb41/test/Spec.hs (L52)) that print + parse arbitrary values and check that we get the same value as a result. They do use any arbitrary unicode character in their generated strings. So... that should have covered it, right?

Well... it turns out that [the tests were ignoring errors](7678066c49/test/Spec.hs (L45)), and would always return "SUCCESS" in CI, even if they failed... Furthermore, the sample size was small enough that, most of the time, _they would not hit such characters_. Running the tests locally on a loop, I only got errors ~10% of the time...

This was all fixed in hasura/graphql-parser-hs#44. This was probably one of Hasura's longest standing bugs? ^^'

### Description

This PR bumps the version of graphql-parser-hs in the engine, and switches some of our own arbitrary tests to use unicode characters in text rather than alphanumeric values. It turns out those tests were much better at hitting "bad" values, and that they consistently failed when generating arbitrary unicode characters.

https://github.com/hasura/graphql-engine-mono/pull/2031

GitOrigin-RevId: 54fa48270386a67336e5544351691619e0684559
2021-08-06 11:54:45 +00:00
..
bench-wrk server: generalize integration tests 2021-03-11 18:18:41 +00:00
benchmarks Jberryman/1720 rts stats tweak 2021-08-05 23:37:53 +00:00
packaging MySQL: Add mysql-client dependencies on CI and in .cabal file 2021-07-12 20:07:46 +00:00
src-exec Disable TLS checks for actions services with self-signed certificates 2021-08-06 03:01:24 +00:00
src-lib Kill Arbitrary, take 2 (fix #1736) 2021-08-06 10:18:37 +00:00
src-rsr tag release v2.0.5 2021-08-05 07:35:10 +00:00
src-test Update GraphQL Parser version to fix text encoding issue (fix #1965) 2021-08-06 11:54:45 +00:00
tests-py Fix/remote nested field customization 2021-08-05 14:59:55 +00:00
.dockerignore update packages (#251) 2018-08-08 13:10:13 +05:30
.gitignore server/citus: feature branch 2021-05-21 02:47:51 +00:00
.hlint.yaml ci: improve hlint messages 2021-05-04 21:52:55 +00:00
.stylish-haskell.yaml ci: run stylish haskell on all incoming PRs 2021-01-21 23:37:26 +00:00
cabal.project Update GraphQL Parser version to fix text encoding issue (fix #1965) 2021-08-06 11:54:45 +00:00
cabal.project.ci update resource limits on circleci [force ci] 2021-01-29 14:36:07 +00:00
cabal.project.dev server: Bump GHC version to 8.10.2 (#5659) 2020-08-26 23:16:23 -05:00
cabal.project.dev-sh dev.sh: restore code coverage functionality 2020-01-23 18:35:18 -05:00
cabal.project.dev-sh.freeze dev.sh: restore code coverage functionality 2020-01-23 18:35:18 -05:00
cabal.project.dev-sh.local ci: improve compilation times by building a dynamic executable 2021-03-22 21:43:43 +00:00
cabal.project.freeze server: add support for tagged and dynamic metrics 2021-08-05 21:08:17 +00:00
commit_diff.txt Rewrite GraphQL schema generation and query parsing (close #2801) (#4111) 2020-08-21 12:27:01 -05:00
CONTRIBUTING.md server/bigquery: Document BigQuery integration tests 2021-07-06 11:13:06 +00:00
graphql-engine.cabal Kill Arbitrary, take 2 (fix #1736) 2021-08-06 10:18:37 +00:00
Makefile ci: don't build non-release with enable_coverage, so perf is comparable 2021-08-03 16:13:51 +00:00
sample.hie.yaml Merge oss/master onto mono/main 2020-11-12 22:37:19 +05:30
Setup.hs move raven into graphql-engine repo 2018-06-28 00:32:00 +05:30
STYLE.md server: Add a Haskell style guide (#2175) 2020-04-08 02:31:30 -05:00