added a new validation phase

fixes

update to latest

run validations as soon as possible

use specified rules instead of default set

cleanup

fix fmt

added more rules

move validation check to Query struct
Added Leaf-Field-Selections rule

fixes

fixes

Added an option to disable graphql validations: `DISABLE_GRAPHQL_VALIDATIONS`

Author: dotansimha

Cargo.lock

@@ -22,6 +22,7 @@ http = "0.2.3"
 fail = { version = "0.5", features = ["failpoints"] }
 futures = "0.1.21"
 graphql-parser = "0.4.0"
+graphql-tools = "0.0.6"
 lazy_static = "1.4.0"
 mockall = "0.8.3"
 num-bigint = { version = "^0.2.6", features = ["serde"] }

graph/Cargo.toml

@@ -41,6 +41,7 @@ pub enum QueryExecutionError {
     AbstractTypeError(String),
     InvalidArgumentError(Pos, String, q::Value),
     MissingArgumentError(Pos, String),
+    ValidationError(Option<Pos>, String),
     InvalidVariableTypeError(Pos, String),
     MissingVariableError(Pos, String),
     ResolveEntitiesError(String),
@@ -137,6 +138,7 @@ impl QueryExecutionError {
             | DeploymentReverted
             | SubgraphManifestResolveError(_)
             | InvalidSubgraphManifest
+            | ValidationError(_, _)
             | ResultTooBig(_, _) => false,
         }
     }
@@ -161,6 +163,9 @@ impl fmt::Display for QueryExecutionError {
             OperationNotFound(s) => {
                 write!(f, "Operation name not found `{}`", s)
             }
+            ValidationError(_pos, message) => {
+                write!(f, "{}", message)
+            }
             NotSupported(s) => write!(f, "Not supported: {}", s),
             NoRootSubscriptionObjectType => {
                 write!(f, "No root Subscription type defined in the schema")

graph/src/data/query/error.rs

@@ -8,6 +8,7 @@ crossbeam = "0.8"
 futures01 = { package="futures", version="0.1.29" }
 graph = { path = "../graph" }
 graphql-parser = "0.4.0"
+graphql-tools = "0.0.8"
 indexmap = "1.7"
 Inflector = "0.11.3"
 lazy_static = "1.2.0"

graphql/Cargo.toml

@@ -1,4 +1,5 @@
 use graphql_parser::Pos;
+use graphql_tools::validation::validate::{validate, ValidationPlan};
 use std::collections::{HashMap, HashSet};
 use std::hash::{Hash, Hasher};
 use std::sync::Arc;
@@ -9,11 +10,10 @@ use graph::data::graphql::{
     ext::{DocumentExt, TypeExt},
     ObjectOrInterface,
 };
+use graph::data::query::QueryExecutionError;
 use graph::data::query::{Query as GraphDataQuery, QueryVariables};
 use graph::data::schema::ApiSchema;
-use graph::prelude::{
-    info, o, q, r, s, BlockNumber, CheapClone, Logger, QueryExecutionError, TryFromValue,
-};
+use graph::prelude::{info, o, q, r, s, BlockNumber, CheapClone, Logger, TryFromValue};
 
 use crate::introspection::introspection_schema;
 use crate::query::{ast as qast, ext::BlockConstraint};
@@ -112,9 +112,24 @@ impl Query {
         schema: Arc<ApiSchema>,
         network: Option<String>,
         query: GraphDataQuery,
+        validation_plan: Arc<ValidationPlan>,
         max_complexity: Option<u64>,
         max_depth: u8,
     ) -> Result<Arc<Self>, Vec<QueryExecutionError>> {
+        let validation_errors = validate(&schema.document(), &query.document, &validation_plan);
+
+        if validation_errors.len() > 0 {
+            return Err(validation_errors
+                .into_iter()
+                .map(|e| {
+                    QueryExecutionError::ValidationError(
+                        e.locations.clone().into_iter().nth(0),
+                        e.message,
+                    )
+                })
+                .collect());
+        }
+
         let mut operation = None;
         let mut fragments = HashMap::new();
         for defn in query.document.definitions.into_iter() {

graphql/src/execution/query.rs

@@ -21,6 +21,11 @@ use graph::{
     data::query::{QueryResults, QueryTarget},
     prelude::QueryStore,
 };
+use graphql_tools::validation::rules::{
+    FragmentsOnCompositeTypes, KnownFragmentNamesRule, LeafFieldSelections, LoneAnonymousOperation,
+    NoUnusedFragments, OverlappingFieldsCanBeMerged,
+};
+use graphql_tools::validation::validate::ValidationPlan;
 
 use lazy_static::lazy_static;
 
@@ -77,6 +82,7 @@ pub struct GraphQlRunner<S, SM> {
     subscription_manager: Arc<SM>,
     load_manager: Arc<LoadManager>,
     result_size: Arc<ResultSizeMetrics>,
+    pub graphql_validation_plan: Arc<ValidationPlan>,
 }
 
 lazy_static! {
@@ -86,6 +92,10 @@ lazy_static! {
             u64::from_str(&s)
                 .unwrap_or_else(|_| panic!("failed to parse env var GRAPH_GRAPHQL_QUERY_TIMEOUT"))
         ));
+    static ref DISABLE_GRAPHQL_VALIDATIONS: bool = std::env::var("DISABLE_GRAPHQL_VALIDATIONS")
+        .unwrap_or_else(|_| "false".into())
+        .parse::<bool>()
+        .unwrap_or_else(|_| false);
     static ref GRAPHQL_MAX_COMPLEXITY: Option<u64> = env::var("GRAPH_GRAPHQL_MAX_COMPLEXITY")
         .ok()
         .map(|s| u64::from_str(&s)
@@ -135,12 +145,24 @@ where
     ) -> Self {
         let logger = logger.new(o!("component" => "GraphQlRunner"));
         let result_size = Arc::new(ResultSizeMetrics::new(registry));
+        let mut graphql_validation_plan = ValidationPlan { rules: Vec::new() };
+
+        if !(*DISABLE_GRAPHQL_VALIDATIONS) {
+            graphql_validation_plan.add_rule(Box::new(LoneAnonymousOperation {}));
+            graphql_validation_plan.add_rule(Box::new(FragmentsOnCompositeTypes {}));
+            graphql_validation_plan.add_rule(Box::new(OverlappingFieldsCanBeMerged {}));
+            graphql_validation_plan.add_rule(Box::new(KnownFragmentNamesRule {}));
+            graphql_validation_plan.add_rule(Box::new(NoUnusedFragments {}));
+            graphql_validation_plan.add_rule(Box::new(LeafFieldSelections {}));
+        }
+
         GraphQlRunner {
             logger,
             store,
             subscription_manager,
             load_manager,
             result_size,
+            graphql_validation_plan: Arc::new(graphql_validation_plan),
         }
     }
 
@@ -212,6 +234,7 @@ where
             schema,
             network,
             query,
+            self.graphql_validation_plan.clone(),
             max_complexity,
             max_depth,
         )?;
@@ -317,6 +340,7 @@ where
             schema,
             Some(network.clone()),
             subscription.query,
+            self.graphql_validation_plan.clone(),
             *GRAPHQL_MAX_COMPLEXITY,
             *GRAPHQL_MAX_DEPTH,
         )?;

graphql/src/runner.rs

@@ -5,6 +5,7 @@ use std::time::{Duration, Instant};
 
 use graph::components::store::UnitStream;
 use graph::{components::store::SubscriptionManager, prelude::*};
+use graphql_tools::validation::validate::ValidationPlan;
 
 use crate::runner::ResultSizeMetrics;
 use crate::{
@@ -51,6 +52,7 @@ pub fn execute_subscription(
         schema,
         None,
         subscription.query,
+        Arc::new(ValidationPlan { rules: vec![] }),
         options.max_complexity,
         options.max_depth,
     )?;

graphql/src/subscription/mod.rs

@@ -14,3 +14,4 @@ http = "0.2"
 hyper = "0.14"
 serde = "1.0"
 either = "1.6.1"
+graphql-tools = "0.0.8"

server/index-node/Cargo.toml

@@ -1,3 +1,4 @@
+use graphql_tools::validation::validate::ValidationPlan;
 use http::header::{
     self, ACCESS_CONTROL_ALLOW_HEADERS, ACCESS_CONTROL_ALLOW_METHODS, ACCESS_CONTROL_ALLOW_ORIGIN,
     CONTENT_TYPE, LOCATION,
@@ -113,7 +114,15 @@ where
             .await?;
 
         let query = IndexNodeRequest::new(body).compat().await?;
-        let query = match PreparedQuery::new(&self.logger, schema, None, query, None, 100) {
+        let query = match PreparedQuery::new(
+            &self.logger,
+            schema,
+            None,
+            query,
+            Arc::new(ValidationPlan { rules: vec![] }),
+            None,
+            100,
+        ) {
             Ok(query) => query,
             Err(e) => return Ok(QueryResults::from(QueryResult::from(e)).as_http_response()),
         };

server/index-node/src/service.rs

@@ -16,3 +16,4 @@ lazy_static = "1.1"
 hex-literal = "0.3"
 diesel = { version = "1.4.8", features = ["postgres", "serde_json", "numeric", "r2d2"] }
 graph-chain-ethereum = { path = "../../chain/ethereum" }
+graphql-tools = "0.0.8"