If a client provides invalid input for the Upload
field (e.g. string or number), strawberry don't raise any errors and executes the related resolver.
@strawberry.type
class Mutation:
@strawberry.mutation
def mutation(self, file: Upload) -> bool:
return True
mutation { mutation (value: "just-a-string") }
If client will provide invalid input for the Upload
field for such a mutation, the mutation will be executed without any errors.
Ordinary fields are validated fine, but Upload
fields are not validated
import pytest
from pytest_mock import MockerFixture
from starlette.testclient import TestClient
import strawberry
from strawberry.file_uploads import Upload
from tests.fastapi.app import create_app
@strawberry.type
class Query:
empty: None = None
@strawberry.input
class SimpleInput:
value: bool
@strawberry.input
class UploadInput:
value: Upload
@pytest.mark.parametrize(
("input_value_annotation", "graphql_type", "bad_variable"),
[
(bool, "Boolean", "not a boolean"),
(SimpleInput, "SimpleInput", "just a string"),
(SimpleInput, "SimpleInput", {"value": "not a boolean"}),
(UploadInput, "UploadInput", "just a string"),
(UploadInput, "UploadInput", {"value": "not an upload"}), # this is currently failing
(Upload, "Upload", "not an upload"), # this is currently failing
],
)
async def test_mutation_input_validation(
mocker: MockerFixture, input_value_annotation, graphql_type, bad_variable
):
mock = mocker.Mock()
def resolver(value) -> bool:
mock()
return True
# dynamic addition of input field annotation:
resolver.__annotations__ = {"value": input_value_annotation}
@strawberry.type
class Mutation:
mutation = strawberry.mutation(resolver, graphql_type=bool)
app = create_app(schema=strawberry.Schema(Query, mutation=Mutation))
response = TestClient(app).post(
"/graphql",
json={
"query": f"mutation($value: {graphql_type}!) {{ mutation(value: $value) }}",
"variables": {"value": bad_variable},
},
)
response_json = response.json()
assert mock.call_count == 0
assert response_json["data"] is None
assert response_json["errors"] is not None
Pay now to fund the work behind this issue.
Get updates on progress being made.
Maintainer is rewarded once the issue is completed.
You're funding impactful open source efforts
You want to contribute to this effort
You want to get funding like this too