Add corrupt query validation

jsn/filter.go

@@ -64,7 +64,7 @@ func Filter(w *bytes.Buffer, b []byte, keys []string) error {
 			state = expectKeyClose
 			s = i
 
-		case state == expectKeyClose && b[i] == '"':
+		case state == expectKeyClose && (b[i-1] != '\\' && b[i] == '"'):
 			state = expectColon
 			k = b[(s + 1):i]
 
@@ -74,7 +74,7 @@ func Filter(w *bytes.Buffer, b []byte, keys []string) error {
 		case state == expectValue && b[i] == '"':
 			state = expectString
 
-		case state == expectString && b[i] == '"':
+		case state == expectString && (b[i-1] != '\\' && b[i] == '"'):
 			e = i
 
 		case state == expectValue && b[i] == '[':

jsn/get.go

@@ -66,7 +66,7 @@ func Get(b []byte, keys [][]byte) []Field {
 			state = expectKeyClose
 			s = i
 
-		case state == expectKeyClose && b[i] == '"':
+		case state == expectKeyClose && (b[i-1] != '\\' && b[i] == '"'):
 			state = expectColon
 			k = b[(s + 1):i]
 
@@ -77,7 +77,7 @@ func Get(b []byte, keys [][]byte) []Field {
 			state = expectString
 			s = i
 
-		case state == expectString && b[i] == '"':
+		case state == expectString && (b[i-1] != '\\' && b[i] == '"'):
 			e = i
 
 		case state == expectValue && b[i] == '[':

jsn/json_test.go

@@ -13,12 +13,12 @@ var (
 	"users": [
 		{
 			"id": 1,
-			"full_name": "Sidney Stroman",
+			"full_name": "'Sidney Stroman'",
 			"email": "user0@demo.com",
 			"__twitter_id": "2048666903444506956",
 			"embed": {
 				"id": 8,
-				"full_name": "Caroll Orn Sr.",
+				"full_name": "Caroll Orn Sr's",
 				"email": "joannarau@hegmann.io",
 				"__twitter_id": "ABC123"
 				"more": [{
@@ -37,7 +37,7 @@ var (
 			"id": 3,
 			"full_name": "Kenna Cassin",
 			"email": "user2@demo.com",
-			"__twitter_id": { "name": "hello", "address": { "work": "1 infinity loop" } }
+			"__twitter_id": { "name": "\"hellos\"", "address": { "work": "1 infinity loop" } }
 		},
 		{
 			"id": 4,
@@ -171,7 +171,7 @@ func TestGet(t *testing.T) {
 		{[]byte("__twitter_id"),
 			[]byte(`[{ "name": "hello" }, { "name": "world"}]`)},
 		{[]byte("__twitter_id"),
-			[]byte(`{ "name": "hello", "address": { "work": "1 infinity loop" } }`),
+			[]byte(`{ "name": "\"hellos\"", "address": { "work": "1 infinity loop" } }`),
 		},
 		{[]byte("__twitter_id"), []byte(`1234567890`)},
 		{[]byte("__twitter_id"), []byte(`1.23E`)},

jsn/keys.go

@@ -47,7 +47,7 @@ func Keys(b []byte) [][]byte {
 			state = expectKeyClose
 			s = i
 
-		case state == expectKeyClose && b[i] == '"':
+		case state == expectKeyClose && (b[i-1] != '\\' && b[i] == '"'):
 			state = expectColon
 			k = b[(s + 1):i]
 
@@ -58,7 +58,7 @@ func Keys(b []byte) [][]byte {
 			state = expectString
 			s = i
 
-		case state == expectString && b[i] == '"':
+		case state == expectString && (b[i-1] != '\\' && b[i] == '"'):
 			e = i
 
 		case state == expectValue && b[i] == '{':

jsn/replace.go

@@ -52,7 +52,7 @@ func Replace(w *bytes.Buffer, b []byte, from, to []Field) error {
 			state = expectKeyClose
 			s = i
 
-		case state == expectKeyClose && b[i] == '"':
+		case state == expectKeyClose && (b[i-1] != '\\' && b[i] == '"'):
 			state = expectColon
 			if _, err := h.Write(b[(s + 1):i]); err != nil {
 				return err
@@ -66,7 +66,7 @@ func Replace(w *bytes.Buffer, b []byte, from, to []Field) error {
 			state = expectString
 			s = i
 
-		case state == expectString && b[i] == '"':
+		case state == expectString && (b[i-1] != '\\' && b[i] == '"'):
 			e = i
 
 		case state == expectValue && b[i] == '[':

jsn/strip.go

@@ -27,7 +27,7 @@ func Strip(b []byte, path [][]byte) []byte {
 			state = expectKeyClose
 			s = i
 
-		case state == expectKeyClose && b[i] == '"':
+		case state == expectKeyClose && (b[i-1] != '\\' && b[i] == '"'):
 			state = expectColon
 			if pi == len(path) {
 				pi = 0
@@ -44,7 +44,7 @@ func Strip(b []byte, path [][]byte) []byte {
 			state = expectString
 			s = i
 
-		case state == expectString && b[i] == '"':
+		case state == expectString && (b[i-1] != '\\' && b[i] == '"'):
 			e = i
 
 		case state == expectValue && b[i] == '[':

psql/query.go

@@ -814,11 +814,15 @@ func (c *compilerContext) renderRelationshipByName(table, parent string, id int3
 }
 
 func (c *compilerContext) renderWhere(sel *qcode.Select, ti *DBTableInfo) error {
-	st := util.NewStack()
-
 	if sel.Where != nil {
-		st.Push(sel.Where)
+		return c.renderExp(sel.Where, ti, false)
 	}
+	return nil
+}
+
+func (c *compilerContext) renderExp(ex *qcode.Exp, ti *DBTableInfo, skipNested bool) error {
+	st := util.NewStack()
+	st.Push(ex)
 
 	for {
 		if st.Len() == 0 {
@@ -873,16 +877,16 @@ func (c *compilerContext) renderWhere(sel *qcode.Select, ti *DBTableInfo) error
 				qcode.FreeExp(val)
 
 			default:
-				if len(val.NestedCols) != 0 {
+				if !skipNested && len(val.NestedCols) != 0 {
 					io.WriteString(c.w, `EXISTS `)
 
-					if err := c.renderNestedWhere(val, sel, ti); err != nil {
+					if err := c.renderNestedWhere(val, ti); err != nil {
 						return err
 					}
 
 				} else {
 					//fmt.Fprintf(w, `(("%s"."%s") `, c.sel.Name, val.Col)
-					if err := c.renderOp(val, sel, ti); err != nil {
+					if err := c.renderOp(val, ti); err != nil {
 						return err
 					}
 					qcode.FreeExp(val)
@@ -898,7 +902,7 @@ func (c *compilerContext) renderWhere(sel *qcode.Select, ti *DBTableInfo) error
 	return nil
 }
 
-func (c *compilerContext) renderNestedWhere(ex *qcode.Exp, sel *qcode.Select, ti *DBTableInfo) error {
+func (c *compilerContext) renderNestedWhere(ex *qcode.Exp, ti *DBTableInfo) error {
 	for i := 0; i < len(ex.NestedCols)-1; i++ {
 		cti, err := c.schema.GetTable(ex.NestedCols[i])
 		if err != nil {
@@ -922,6 +926,14 @@ func (c *compilerContext) renderNestedWhere(ex *qcode.Exp, sel *qcode.Select, ti
 			return err
 		}
 
+		io.WriteString(c.w, ` AND (`)
+
+		if err := c.renderExp(ex, cti, true); err != nil {
+			return err
+		}
+
+		io.WriteString(c.w, `)`)
+
 	}
 
 	for i := 0; i < len(ex.NestedCols)-1; i++ {
@@ -931,7 +943,7 @@ func (c *compilerContext) renderNestedWhere(ex *qcode.Exp, sel *qcode.Select, ti
 	return nil
 }
 
-func (c *compilerContext) renderOp(ex *qcode.Exp, sel *qcode.Select, ti *DBTableInfo) error {
+func (c *compilerContext) renderOp(ex *qcode.Exp, ti *DBTableInfo) error {
 	var col *DBColumn
 	var ok bool
 
@@ -1029,10 +1041,9 @@ func (c *compilerContext) renderOp(ex *qcode.Exp, sel *qcode.Select, ti *DBTable
 
 	if ex.Type == qcode.ValList {
 		c.renderList(ex)
+	} else if col == nil {
+		return errors.New("no column found for expression value")
 	} else {
-		if col == nil {
-			return errors.New("no column found for expression value")
-		}
 		c.renderVal(ex, c.vars, col)
 	}
 

psql/query_test.go

@@ -209,20 +209,20 @@ func oneToManyReverse(t *testing.T) {
 }
 
 func oneToManyArray(t *testing.T) {
-	gql := `query {
+	gql := `
+	query {
+		product {
+			name
+			price
+			tags {
+				id
+				name
+			}
+		}
+		tags {
+			name
 			product {
 				name
-				price
-				tags {
-					id
-					name
-				}
-			}
-			tags {
-				name
-				product {
-					name
-				}
 			}
 		}
 	}`
@@ -409,7 +409,7 @@ func withWhereOnRelations(t *testing.T) {
 		users(where: { 
 				not: { 
 					products: { 
-						price: { gt: 3 } 
+						price: { gt: 3 }
 					} 
 				} 
 			}) {
@@ -418,7 +418,7 @@ func withWhereOnRelations(t *testing.T) {
 		}
 	}`
 
-	sql := `SELECT json_object_agg('users', json_0) FROM (SELECT coalesce(json_agg("json_0"), '[]') AS "json_0" FROM (SELECT row_to_json((SELECT "json_row_0" FROM (SELECT "users_0"."id" AS "id", "users_0"."email" AS "email") AS "json_row_0")) AS "json_0" FROM (SELECT "users"."id", "users"."email" FROM "users" WHERE (NOT EXISTS (SELECT 1 FROM products WHERE (("products"."user_id") = ("users"."id")))) LIMIT ('20') :: integer) AS "users_0" LIMIT ('20') :: integer) AS "json_agg_0") AS "sel_0"`
+	sql := `SELECT json_object_agg('users', json_0) FROM (SELECT coalesce(json_agg("json_0"), '[]') AS "json_0" FROM (SELECT row_to_json((SELECT "json_row_0" FROM (SELECT "users_0"."id" AS "id", "users_0"."email" AS "email") AS "json_row_0")) AS "json_0" FROM (SELECT "users"."id", "users"."email" FROM "users" WHERE (NOT EXISTS (SELECT 1 FROM products WHERE (("products"."user_id") = ("users"."id")) AND ((("products"."price") > 3)))) LIMIT ('20') :: integer) AS "users_0" LIMIT ('20') :: integer) AS "json_agg_0") AS "sel_0"`
 
 	resSQL, err := compileGQLToPSQL(gql, nil, "user")
 	if err != nil {

psql/schema.go

@@ -5,7 +5,6 @@ import (
 	"strings"
 
 	"github.com/gobuffalo/flect"
-	"github.com/jackc/pgx/v4/pgxpool"
 )
 
 type DBSchema struct {
@@ -51,8 +50,7 @@ type DBRel struct {
 	}
 }
 
-func NewDBSchema(db *pgxpool.Pool,
-	info *DBInfo, aliases map[string][]string) (*DBSchema, error) {
+func NewDBSchema(info *DBInfo, aliases map[string][]string) (*DBSchema, error) {
 
 	schema := &DBSchema{
 		t:  make(map[string]*DBTableInfo),
@@ -322,8 +320,21 @@ func (s *DBSchema) SetRel(child, parent string, rel *DBRel) error {
 func (s *DBSchema) GetRel(child, parent string) (*DBRel, error) {
 	rel, ok := s.rm[child][parent]
 	if !ok {
-		return nil, fmt.Errorf("unknown relationship '%s' -> '%s'",
-			child, parent)
+		// No relationship found so this time fetch the table info
+		// and try again in case child or parent was an alias
+		ct, err := s.GetTable(child)
+		if err != nil {
+			return nil, err
+		}
+		pt, err := s.GetTable(parent)
+		if err != nil {
+			return nil, err
+		}
+		rel, ok = s.rm[ct.Name][pt.Name]
+		if !ok {
+			return nil, fmt.Errorf("unknown relationship '%s' -> '%s'",
+				child, parent)
+		}
 	}
 	return rel, nil
 }

qcode/config.go

@@ -80,7 +80,7 @@ func (trv *trval) allowedColumns(qt QType) map[string]struct{} {
 	case QTUpdate:
 		return trv.update.cols
 	case QTDelete:
-		return trv.insert.cols
+		return trv.delete.cols
 	case QTUpsert:
 		return trv.insert.cols
 	}

qcode/lex.go

@@ -31,7 +31,7 @@ type item struct {
 	_type itemType // The type of this item.
 	pos   Pos      // The starting position, in bytes, of this item in the input string.
 	end   Pos      // The ending position, in bytes, of this item in the input string.
-	line  uint16   // The line number at the start of this item.
+	line  int16    // The line number at the start of this item.
 }
 
 // itemType identifies the type of lex items.
@@ -87,7 +87,7 @@ type lexer struct {
 	width  Pos    // width of last rune read from input
 	items  []item // array of scanned items
 	itemsA [50]item
-	line   uint16 // 1+number of newlines seen
+	line   int16 // 1+number of newlines seen
 	err    error
 }
 
@@ -137,7 +137,7 @@ func (l *lexer) emit(t itemType) {
 	l.items = append(l.items, item{t, l.start, l.pos, l.line})
 	// Some items contain text internally. If so, count their newlines.
 	switch t {
-	case itemName:
+	case itemStringVal:
 		for i := l.start; i < l.pos; i++ {
 			if l.input[i] == '\n' {
 				l.line++
@@ -155,11 +155,6 @@ func (l *lexer) emitL(t itemType) {
 
 // ignore skips over the pending input before this point.
 func (l *lexer) ignore() {
-	for i := l.start; i < l.pos; i++ {
-		if l.input[i] == '\n' {
-			l.line++
-		}
-	}
 	l.start = l.pos
 }
 
@@ -436,7 +431,7 @@ func lowercase(b []byte, s Pos, e Pos) {
 	}
 }
 
-func (i *item) String() string {
+func (i item) String() string {
 	var v string
 
 	switch i._type {

qcode/parse.go

@@ -156,12 +156,24 @@ func parseSelectionSet(gql []byte) (*Operation, error) {
 		return nil, err
 	}
 
-	lexPool.Put(l)
-
-	if err != nil {
-		return nil, err
+	if p.peek(itemObjClose) {
+		p.ignore()
+	} else {
+		return nil, fmt.Errorf("operation missing closing '}'")
 	}
 
+	if !p.peek(itemEOF) {
+		p.ignore()
+		return nil, fmt.Errorf("invalid '%s' found after closing '}'", p.current())
+	}
+
+	// for i := p.pos; i < len(p.items); i++ {
+	// 	fmt.Printf("2>>>> %#v\n", p.items[i])
+	// }
+	//return nil, fmt.Errorf("unexpected token")
+
+	lexPool.Put(l)
+
 	return op, err
 }
 
@@ -184,11 +196,16 @@ func (p *Parser) ignore() {
 	p.pos = n
 }
 
+func (p *Parser) current() string {
+	item := p.items[p.pos]
+	return b2s(p.input[item.pos:item.end])
+}
+
 func (p *Parser) peek(types ...itemType) bool {
 	n := p.pos + 1
-	if p.items[n]._type == itemEOF {
-		return false
-	}
+	// if p.items[n]._type == itemEOF {
+	// 	return false
+	// }
 	if n >= len(p.items) {
 		return false
 	}
@@ -292,8 +309,9 @@ func (p *Parser) parseFields(fields []Field) ([]Field, error) {
 
 			if st.Len() == 0 {
 				break
+			} else {
+				continue
 			}
-			continue
 		}
 
 		if !p.peek(itemName) {
@@ -306,6 +324,8 @@ func (p *Parser) parseFields(fields []Field) ([]Field, error) {
 		f.Args = f.argsA[:0]
 		f.Children = f.childrenA[:0]
 
+		// Parse the inside of the the fields () parentheses
+		// in short parse the args like id, where, etc
 		if err := p.parseField(f); err != nil {
 			return nil, err
 		}
@@ -318,6 +338,8 @@ func (p *Parser) parseFields(fields []Field) ([]Field, error) {
 			f.ParentID = -1
 		}
 
+		// The first opening curley brackets after this
+		// comes the columns or child fields
 		if p.peek(itemObjOpen) {
 			p.ignore()
 			st.Push(f.ID)

qcode/parse_test.go

@@ -17,7 +17,7 @@ func TestCompile1(t *testing.T) {
 	}
 
 	_, err = qc.Compile([]byte(`
-	{ product(id: 15) {
+	query { product(id: 15) {
 			id
 			name
 		} }`), "user")
@@ -100,6 +100,35 @@ func TestEmptyCompile(t *testing.T) {
 	}
 }
 
+func TestInvalidPostfixCompile(t *testing.T) {
+	gql := `mutation 
+updateThread {
+  thread(update: $data, where: { slug: { eq: $slug } }) {
+    slug
+    title
+    published
+    createdAt : created_at
+    totalVotes : cached_votes_total
+    totalPosts : cached_posts_total
+    vote : thread_vote(where: { user_id: { eq: $user_id } }) {
+     id
+    }
+    topics {
+      slug
+      name
+    }
+	}
+}
+}`
+	qcompile, _ := NewCompiler(Config{})
+	_, err := qcompile.Compile([]byte(gql), "anon")
+
+	if err == nil {
+		t.Fatal(errors.New("expecting an error"))
+	}
+
+}
+
 var gql = []byte(`
 	products(
 		# returns only 30 items

qcode/qcode.go

@@ -940,10 +940,13 @@ func setWhereColName(ex *Exp, node *Node) {
 			list = append([]string{k}, list...)
 		}
 	}
-	if len(list) == 1 {
+	listlen := len(list)
+
+	if listlen == 1 {
 		ex.Col = list[0]
-	} else if len(list) > 1 {
-		ex.NestedCols = list
+	} else if listlen > 1 {
+		ex.Col = list[listlen-1]
+		ex.NestedCols = list[:listlen]
 	}
 }
 
@@ -996,6 +999,11 @@ func compileFilter(filter []string) (*Exp, error) {
 			return nil, err
 		}
 
+		// TODO: Invalid table names in nested where causes fail silently
+		// returning a nil 'f' this needs to be fixed
+
+		// TODO: Invalid where clauses such as missing op (eg. eq) also fail silently
+
 		if fl == nil {
 			fl = f
 		} else {

serv/args.go

@@ -34,6 +34,7 @@ func argMap(ctx context.Context, vars []byte) func(w io.Writer, tag string) (int
 		}
 
 		fields := jsn.Get(vars, [][]byte{[]byte(tag)})
+
 		if len(fields) == 0 {
 			return 0, nil
 		}
@@ -42,7 +43,7 @@ func argMap(ctx context.Context, vars []byte) func(w io.Writer, tag string) (int
 			fields[0].Value = v[1 : len(v)-1]
 		}
 
-		return w.Write(fields[0].Value)
+		return w.Write(escQuote(fields[0].Value))
 	}
 }
 
@@ -89,7 +90,7 @@ func argList(ctx *coreContext, args [][]byte) ([]interface{}, error) {
 			if v, ok := fields[string(av)]; ok {
 				switch v[0] {
 				case '[', '{':
-					vars[i] = v
+					vars[i] = escQuote(v)
 				default:
 					var val interface{}
 					if err := json.Unmarshal(v, &val); err != nil {
@@ -106,3 +107,31 @@ func argList(ctx *coreContext, args [][]byte) ([]interface{}, error) {
 
 	return vars, nil
 }
+
+func escQuote(b []byte) []byte {
+	f := false
+	for i := range b {
+		if b[i] == '\'' {
+			f = true
+			break
+		}
+	}
+	if !f {
+		return b
+	}
+
+	buf := &bytes.Buffer{}
+	s := 0
+	for i := range b {
+		if b[i] == '\'' {
+			buf.Write(b[s:i])
+			buf.WriteString(`''`)
+			s = i + 1
+		}
+	}
+	l := len(b)
+	if s < (l - 1) {
+		buf.Write(b[s:l])
+	}
+	return buf.Bytes()
+}

serv/cmd_new.go

@@ -90,8 +90,8 @@ func cmdNew(cmd *cobra.Command, args []string) {
 		return os.Mkdir(p, os.ModePerm)
 	})
 
-	ifNotExists(path.Join(appMigrationsPath, "100_init.sql"), func(p string) error {
-		if v, err := tmpl.get("100_init.sql"); err == nil {
+	ifNotExists(path.Join(appMigrationsPath, "0_init.sql"), func(p string) error {
+		if v, err := tmpl.get("0_init.sql"); err == nil {
 			return ioutil.WriteFile(p, v, 0644)
 		} else {
 			return err

serv/config_compile.go

@@ -80,26 +80,26 @@ func addRole(qc *qcode.Compiler, r configRole, t configRoleTable) error {
 		Presets: t.Insert.Presets,
 	}
 
-	if t.Query.Block {
+	if t.Insert.Block {
 		insert.Filters = blockFilter
 	}
 
 	update := qcode.UpdateConfig{
-		Filters: t.Insert.Filters,
-		Columns: t.Insert.Columns,
-		Presets: t.Insert.Presets,
+		Filters: t.Update.Filters,
+		Columns: t.Update.Columns,
+		Presets: t.Update.Presets,
 	}
 
-	if t.Query.Block {
+	if t.Update.Block {
 		update.Filters = blockFilter
 	}
 
 	delete := qcode.DeleteConfig{
-		Filters: t.Insert.Filters,
-		Columns: t.Insert.Columns,
+		Filters: t.Delete.Filters,
+		Columns: t.Delete.Columns,
 	}
 
-	if t.Query.Block {
+	if t.Delete.Block {
 		delete.Filters = blockFilter
 	}
 

serv/serv.go

@@ -25,7 +25,7 @@ func initCompilers(c *config) (*qcode.Compiler, *psql.Compiler, error) {
 		return nil, nil, err
 	}
 
-	schema, err = psql.NewDBSchema(db, di, c.getAliasMap())
+	schema, err = psql.NewDBSchema(di, c.getAliasMap())
 	if err != nil {
 		return nil, nil, err
 	}