Add support for validation rules by kiendang · Pull Request #1475 · graphql-python/graphene-django

kiendang · 2023-11-01T02:50:13Z

sjdemartini

This approach LGTM! Maybe worth a quick mention in some docs/ file about how to specify validation_rules? And a quick test seems worthwhile before merging.

Thanks for adding this! 🎉

kiendang · 2023-11-23T20:55:50Z

@firaskafri should we release another patch version (v3.1.6) before merging this? I think this deserves a minor bump to v3.2.0 but there were a couple of small bug fixing PRs merged since v3.1.5 so I think it's a good idea to have another patch version for v3.1.

sjdemartini

💯

Awesome stuff! Really appreciate the clear docs examples and tests!

Agreed with your suggestion that we should release another patch version (v3.1.6) before merging this and releasing this as a minor bump to 3.2.0

sjdemartini · 2023-11-28T02:29:59Z

graphene_django/tests/test_views.py

+def test_validation_disallow_introspection(client, url):
+    response = client.post(url_string(url, query="{__schema {queryType {name}}}"))
+
+    assert response.status_code == 400


How about we also check that the json representation of the response does not contain the __schema in its data (or data is null/empty, however it appears in practice)? That way we ensure it's not merely returning a 400 and the error message, but is also omitting the introspection data from the response as intended. (Same goes for the other 400 error tests below)

Good point!

pmcarlos

This looks good to me, testing it locally with another approach I used to have

kiendang · 2023-12-14T07:18:10Z

This looks good to me, testing it locally with another approach I used to have

@pmcarlos Would you be able to share your current method? This PR is to be merged eventually but there's someone in Graphene Discord asking if there's another way to disable introspection.

lee-pai-long · 2023-12-20T09:30:08Z

Hi guys, any idea when this PR will be merged ?

kiendang · 2023-12-20T09:40:00Z

Hi guys, any idea when this PR will be merged ?

This would be part of the 3.2.0 release. The plan is to release another patch version 3.1.6 with the current main branch, then we'll merge this PR and do a 3.2.0 later. @firaskafri is there any roadblock on making a 3.1.6 release?

firaskafri · 2023-12-20T09:45:55Z

Hi guys, any idea when this PR will be merged ?

This would be part of the 3.2.0 release. The plan is to release another patch version 3.1.6 with the current main branch, then we'll merge this PR and do a 3.2.0 later. @firaskafri is there any roadblock on making a 3.1.6 release?

Hello @kiendang not at all.
I just released 3.1.6 and merging this to main now.

kiendang · 2023-12-20T10:00:11Z

Hi guys, any idea when this PR will be merged ?

This would be part of the 3.2.0 release. The plan is to release another patch version 3.1.6 with the current main branch, then we'll merge this PR and do a 3.2.0 later. @firaskafri is there any roadblock on making a 3.1.6 release?

Hello @kiendang not at all. I just released 3.1.6 and merging this to main now.

@firaskafri Awesome. Thanks! We're good to go for 3.2.0 as well.

lee-pai-long · 2023-12-22T11:01:18Z

Hi @kiendang any example on how to implement both rules ? I tried to follow the graphene documentation:

from graphene import Schema
from .auto import schema_operations_builder
from graphql import validate, parse
from graphene.validation import depth_limit_validator, DisableIntrospection

schema = Schema(query=ALL_QUERIES, mutation=ALL_MUTATIONS)

validation_errors = validate(
    schema=schema.graphql_schema,
    document_ast=parse('THE QUERY'),
    rules=(
        depth_limit_validator(max_depth=10),
        DisableIntrospection
    )
)

But I get an error ModuleNotFoundError: No module named 'graphene.validation'

kiendang · 2023-12-23T16:22:30Z

@lee-pai-long hmm that's weird. It comes with Graphene. We have a test for it in this repo and it works fine. You can try taking a look at your installed packages? Alternatively the introspection disabling rule is also implemented in graphql-core. You can do

from graphql.validation.rules.custom.no_schema_introspection import NoSchemaIntrospectionCustomRule

NoSchemaIntrospectionCustomRule is the same as graphene.validation.DisableIntrospection. However depth_limit_validator is only available in Graphene though.

lee-pai-long · 2024-01-09T09:35:58Z

Hi @kiendang thanks for you help, actually my error was that I didn't have the right version of graphene, after upgrading it and the other dependencies I can import the validation module.

* Add support for validation rules * Enable customizing validate max_errors through settings * Add tests for validation rules * Add examples for validation rules * Allow setting validation_rules in class def * Add tests for validation_rules inherited from parent class * Make tests for validation rules stricter

kiendang added 2 commits November 1, 2023 10:30

Add support for validation rules

f889000

Enable customizing validate max_errors through settings

918b590

kiendang mentioned this pull request Nov 1, 2023

Query Limiting Depth #1472

Closed

sjdemartini reviewed Nov 1, 2023

View reviewed changes

derrabauke mentioned this pull request Nov 7, 2023

fix(graphql): disable introspection endpoint on production projectcaluma/caluma#2098

Closed

kiendang mentioned this pull request Nov 21, 2023

Options to secure API #1478

Closed

kiendang added 2 commits November 24, 2023 04:30

Add tests for validation rules

3ca1244

Add examples for validation rules

9a56a2b

kiendang requested review from firaskafri and sjdemartini November 23, 2023 20:52

Allow setting validation_rules in class def

8eeffc7

kiendang force-pushed the validation-rules branch from dfbb8bf to 8eeffc7 Compare November 23, 2023 21:10

Add tests for validation_rules inherited from parent class

9561ec3

sjdemartini approved these changes Nov 28, 2023

View reviewed changes

Make tests for validation rules stricter

d006547

kiendang added this to the v3.6.0 milestone Dec 3, 2023

pmcarlos approved these changes Dec 14, 2023

View reviewed changes

kiendang modified the milestone: v3.2.0 Dec 14, 2023

firaskafri approved these changes Dec 20, 2023

View reviewed changes

firaskafri merged commit feb7252 into main Dec 20, 2023

firaskafri deleted the validation-rules branch December 20, 2023 09:48

Conversation

kiendang commented Nov 1, 2023

Uh oh!

sjdemartini left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kiendang commented Nov 23, 2023

Uh oh!

sjdemartini left a comment

Choose a reason for hiding this comment

Uh oh!

sjdemartini Nov 28, 2023

Choose a reason for hiding this comment

Uh oh!

kiendang Nov 28, 2023

Choose a reason for hiding this comment

Uh oh!

pmcarlos left a comment

Choose a reason for hiding this comment

Uh oh!

kiendang commented Dec 14, 2023

Uh oh!

lee-pai-long commented Dec 20, 2023

Uh oh!

kiendang commented Dec 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

firaskafri commented Dec 20, 2023

Uh oh!

kiendang commented Dec 20, 2023

Uh oh!

lee-pai-long commented Dec 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kiendang commented Dec 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lee-pai-long commented Jan 9, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sjdemartini left a comment •

edited

Loading

kiendang commented Dec 20, 2023 •

edited

Loading

lee-pai-long commented Dec 22, 2023 •

edited

Loading

kiendang commented Dec 23, 2023 •

edited

Loading