From 3d599ad7ab4142290995422302cd6e4757d47c16 Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Thu, 6 Apr 2023 11:56:19 +0800
Subject: [PATCH 1/2] Remove sanitize directive on query argument because we
 will change the argument type if doing so

---
 packages/api/src/directives.ts            | 38 -----------------------
 packages/api/src/generated/schema.graphql |  2 +-
 packages/api/src/schema.ts                |  4 +--
 3 files changed, 3 insertions(+), 41 deletions(-)

diff --git a/packages/api/src/directives.ts b/packages/api/src/directives.ts
index 15e212cb7..292a546b8 100644
--- a/packages/api/src/directives.ts
+++ b/packages/api/src/directives.ts
@@ -46,43 +46,5 @@ export const sanitizeDirectiveTransformer = (schema: GraphQLSchema) => {
       }
       return fieldConfig
     },
-    [MapperKind.ARGUMENT]: (argConfig) => {
-      const sanitizeDirective = getDirective(schema, argConfig, 'sanitize')?.[0]
-      if (!sanitizeDirective) {
-        return argConfig
-      }
-
-      const maxLength = sanitizeDirective.maxLength as number | undefined
-      const minLength = sanitizeDirective.minLength as number | undefined
-      const allowedTags = sanitizeDirective.allowedTags as string[] | undefined
-      const pattern = sanitizeDirective.pattern as string | undefined
-
-      if (
-        argConfig.type instanceof GraphQLNonNull &&
-        argConfig.type.ofType instanceof GraphQLScalarType
-      ) {
-        argConfig.type = new GraphQLNonNull(
-          new SanitizedString(
-            argConfig.type.ofType,
-            allowedTags,
-            maxLength,
-            minLength,
-            pattern
-          )
-        )
-      } else if (argConfig.type instanceof GraphQLScalarType) {
-        argConfig.type = new SanitizedString(
-          argConfig.type,
-          allowedTags,
-          maxLength,
-          minLength,
-          pattern
-        )
-      } else {
-        // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-        throw new Error(`Not a scalar type: ${argConfig.type}`)
-      }
-      return argConfig
-    },
   })
 }
diff --git a/packages/api/src/generated/schema.graphql b/packages/api/src/generated/schema.graphql
index 2149a5ebd..7490fb535 100644
--- a/packages/api/src/generated/schema.graphql
+++ b/packages/api/src/generated/schema.graphql
@@ -1,4 +1,4 @@
-directive @sanitize(allowedTags: [String], maxLength: Int, minLength: Int, pattern: String) on ARGUMENT_DEFINITION | INPUT_FIELD_DEFINITION
+directive @sanitize(allowedTags: [String], maxLength: Int, minLength: Int, pattern: String) on INPUT_FIELD_DEFINITION
 
 type AddPopularReadError {
   errorCodes: [AddPopularReadErrorCode!]!
diff --git a/packages/api/src/schema.ts b/packages/api/src/schema.ts
index 61f735b19..c409027c1 100755
--- a/packages/api/src/schema.ts
+++ b/packages/api/src/schema.ts
@@ -10,7 +10,7 @@ const schema = gql`
     maxLength: Int
     minLength: Int
     pattern: String
-  ) on INPUT_FIELD_DEFINITION | ARGUMENT_DEFINITION
+  ) on INPUT_FIELD_DEFINITION
 
   enum SortOrder {
     ASCENDING
@@ -2542,7 +2542,7 @@ const schema = gql`
     search(
       after: String
       first: Int
-      query: String @sanitize(maxLength: 255)
+      query: String
       includeContent: Boolean
       format: String
     ): SearchResult!

From 83cd0ac880a4c8de5635c4b42a78706c99c51ee9 Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Thu, 6 Apr 2023 12:03:26 +0800
Subject: [PATCH 2/2] Return error if query exceeds 255 char

---
 packages/api/src/generated/graphql.ts       | 1 +
 packages/api/src/generated/schema.graphql   | 1 +
 packages/api/src/resolvers/article/index.ts | 6 ++++++
 packages/api/src/schema.ts                  | 1 +
 4 files changed, 9 insertions(+)

diff --git a/packages/api/src/generated/graphql.ts b/packages/api/src/generated/graphql.ts
index d1c96d1cf..222de229a 100644
--- a/packages/api/src/generated/graphql.ts
+++ b/packages/api/src/generated/graphql.ts
@@ -2223,6 +2223,7 @@ export type SearchError = {
 };
 
 export enum SearchErrorCode {
+  QueryTooLong = 'QUERY_TOO_LONG',
   Unauthorized = 'UNAUTHORIZED'
 }
 
diff --git a/packages/api/src/generated/schema.graphql b/packages/api/src/generated/schema.graphql
index 7490fb535..bee6ae46c 100644
--- a/packages/api/src/generated/schema.graphql
+++ b/packages/api/src/generated/schema.graphql
@@ -1623,6 +1623,7 @@ type SearchError {
 }
 
 enum SearchErrorCode {
+  QUERY_TOO_LONG
   UNAUTHORIZED
 }
 
diff --git a/packages/api/src/resolvers/article/index.ts b/packages/api/src/resolvers/article/index.ts
index defec536c..041d930c1 100644
--- a/packages/api/src/resolvers/article/index.ts
+++ b/packages/api/src/resolvers/article/index.ts
@@ -53,6 +53,7 @@ import {
   SaveArticleReadingProgressErrorCode,
   SaveArticleReadingProgressSuccess,
   SearchError,
+  SearchErrorCode,
   SearchItem,
   SearchSuccess,
   SetBookmarkArticleError,
@@ -873,6 +874,11 @@ export const searchResolver = authorized<
   const startCursor = params.after || ''
   const first = params.first || 10
 
+  // the query size is limited to 255 characters
+  if (params.query && params.query.length > 255) {
+    return { errorCodes: [SearchErrorCode.QueryTooLong] }
+  }
+
   const searchQuery = parseSearchQuery(params.query || undefined)
 
   analytics.track({
diff --git a/packages/api/src/schema.ts b/packages/api/src/schema.ts
index c409027c1..d749e97d6 100755
--- a/packages/api/src/schema.ts
+++ b/packages/api/src/schema.ts
@@ -1587,6 +1587,7 @@ const schema = gql`
 
   enum SearchErrorCode {
     UNAUTHORIZED
+    QUERY_TOO_LONG
   }
 
   type SearchError {