Merge pull request #1991 from omnivore-app/fix/search-query-sanitize

fix/search query sanitize

packages/api/src/directives.ts

@@ -46,43 +46,5 @@ export const sanitizeDirectiveTransformer = (schema: GraphQLSchema) => {
       }
       return fieldConfig
     },
-    [MapperKind.ARGUMENT]: (argConfig) => {
-      const sanitizeDirective = getDirective(schema, argConfig, 'sanitize')?.[0]
-      if (!sanitizeDirective) {
-        return argConfig
-      }
-
-      const maxLength = sanitizeDirective.maxLength as number | undefined
-      const minLength = sanitizeDirective.minLength as number | undefined
-      const allowedTags = sanitizeDirective.allowedTags as string[] | undefined
-      const pattern = sanitizeDirective.pattern as string | undefined
-
-      if (
-        argConfig.type instanceof GraphQLNonNull &&
-        argConfig.type.ofType instanceof GraphQLScalarType
-      ) {
-        argConfig.type = new GraphQLNonNull(
-          new SanitizedString(
-            argConfig.type.ofType,
-            allowedTags,
-            maxLength,
-            minLength,
-            pattern
-          )
-        )
-      } else if (argConfig.type instanceof GraphQLScalarType) {
-        argConfig.type = new SanitizedString(
-          argConfig.type,
-          allowedTags,
-          maxLength,
-          minLength,
-          pattern
-        )
-      } else {
-        // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-        throw new Error(`Not a scalar type: ${argConfig.type}`)
-      }
-      return argConfig
-    },
   })
 }

packages/api/src/generated/graphql.ts

@@ -2223,6 +2223,7 @@ export type SearchError = {
 };
 
 export enum SearchErrorCode {
+  QueryTooLong = 'QUERY_TOO_LONG',
   Unauthorized = 'UNAUTHORIZED'
 }
 

packages/api/src/generated/schema.graphql

@@ -1,4 +1,4 @@
-directive @sanitize(allowedTags: [String], maxLength: Int, minLength: Int, pattern: String) on ARGUMENT_DEFINITION | INPUT_FIELD_DEFINITION
+directive @sanitize(allowedTags: [String], maxLength: Int, minLength: Int, pattern: String) on INPUT_FIELD_DEFINITION
 
 type AddPopularReadError {
   errorCodes: [AddPopularReadErrorCode!]!
@@ -1623,6 +1623,7 @@ type SearchError {
 }
 
 enum SearchErrorCode {
+  QUERY_TOO_LONG
   UNAUTHORIZED
 }
 

packages/api/src/resolvers/article/index.ts

@@ -53,6 +53,7 @@ import {
   SaveArticleReadingProgressErrorCode,
   SaveArticleReadingProgressSuccess,
   SearchError,
+  SearchErrorCode,
   SearchItem,
   SearchSuccess,
   SetBookmarkArticleError,
@@ -873,6 +874,11 @@ export const searchResolver = authorized<
   const startCursor = params.after || ''
   const first = params.first || 10
 
+  // the query size is limited to 255 characters
+  if (params.query && params.query.length > 255) {
+    return { errorCodes: [SearchErrorCode.QueryTooLong] }
+  }
+
   const searchQuery = parseSearchQuery(params.query || undefined)
 
   analytics.track({

packages/api/src/schema.ts

@@ -10,7 +10,7 @@ const schema = gql`
     maxLength: Int
     minLength: Int
     pattern: String
-  ) on INPUT_FIELD_DEFINITION | ARGUMENT_DEFINITION
+  ) on INPUT_FIELD_DEFINITION
 
   enum SortOrder {
     ASCENDING
@@ -1587,6 +1587,7 @@ const schema = gql`
 
   enum SearchErrorCode {
     UNAUTHORIZED
+    QUERY_TOO_LONG
   }
 
   type SearchError {
@@ -2542,7 +2543,7 @@ const schema = gql`
     search(
       after: String
       first: Int
-      query: String @sanitize(maxLength: 255)
+      query: String
       includeContent: Boolean
       format: String
     ): SearchResult!