Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

compare URI-decoded path params #482

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

compare URI-decoded path params #482

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bea5e63
compare URI-decoded path params
zvkemp Oct 22, 2024
1ba654e
make uri decoding configurable
zvkemp Oct 25, 2024
ea2030b
Merge branch 'master' into fix-encoded-params
jkeen Nov 6, 2024
f5a02b5
Merge branch 'master' into fix-encoded-params
jkeen Nov 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions lib/graphiti/adapters/null.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,14 @@ def filter_boolean_eq(scope, attribute, value)
scope
end

def filter_uuid_eq(scope, attribute, value)
scope
end

def filter_uuid_not_eq(scope, attribute, value)
scope
end

def base_scope(model)
{}
end
Expand Down
6 changes: 3 additions & 3 deletions lib/graphiti/resource/links.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,12 +74,12 @@ def allow_request?(request_path, params, action)
endpoints.any? do |e|
has_id = params[:id] || params[:data].try(:[], :id)
path = request_path
if [:update, :show, :destroy].include?(context_namespace) && has_id
if [:update, :show, :destroy].include?(action) && has_id
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

action is passed in by the caller; seems appropriate to use it here instead of duplicating the call to context_namespace

path = request_path.split("/")
path.pop if path.last == has_id.to_s
path.pop if URI.decode_uri_component(path.last) == has_id.to_s
path = path.join("/")
end
e[:full_path].to_s == path && e[:actions].include?(context_namespace)
e[:full_path].to_s == path && e[:actions].include?(action)
end
end

Expand Down
17 changes: 17 additions & 0 deletions spec/resource_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1238,6 +1238,23 @@ def self.name
end
end
end

context "with a url-encoded path param" do
before do
request.env["PATH_INFO"] += "/123%3B456"

klass.instance_exec do
attribute :id, :uuid
end
end

it "works" do
klass
Graphiti.with_context ctx, :show do
expect { klass.find(id: "123;456") }.to_not raise_error
end
end
end
end

context "and the request matches a secondary endpoint" do
Expand Down
Loading