Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ability to disable file uploads with Starlette integration #417

Open
mcho421 opened this issue Aug 29, 2020 · 1 comment
Open

Ability to disable file uploads with Starlette integration #417

mcho421 opened this issue Aug 29, 2020 · 1 comment
Labels
to do

Comments

@mcho421
Copy link

mcho421 commented Aug 29, 2020 •
edited

Would it be possible to have an option to disable file uploads with the Starlette integration (regardless of whether python-multipart is installed or not)?

I was reading https://ariadnegraphql.org/docs/other-integrations and was wondering whether it safe to allow GraphQL requests with a content type of multipart/form-data, since it mentions that only application/json should be allowed.

For example, if you have pip install python-multipart installed, and Starlette application main.py like:

from ariadne import QueryType, make_executable_schema, MutationType
from ariadne.asgi import GraphQL
from starlette.applications import Starlette

type_defs = """
    type Query {
        hello: String!
    }
    type Mutation {
        changeState: String!
    }
"""

query = QueryType()
mutation = MutationType()

counter = 0


@query.field("hello")
def resolve_hello(*_):
    return "Hello world!"


@mutation.field("changeState")
def resolve_change_state(*_):
    # Do some change to a database
    global counter
    counter += 1
    return counter


# Create executable schema instance
schema = make_executable_schema(type_defs, [query, mutation])

app = Starlette(debug=True)
app.mount("/graphql", GraphQL(schema, debug=True))
# run with $ uvicorn main:app

You could be tricked to click a button defined like this on a different website which could cause an unintended state change:

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8"/>
  <title>upload</title>
</head>
<body>
<form action="http://127.0.0.1:8000/graphql/" method="post" enctype="multipart/form-data">
  <p><input type="text" name="operations" value='{"query": "mutation {\n  changeState\n}\n"}'>
  <p><input type="text" name="map" value='{"file1": ["path1"]}'>
  <p><input type="file" name="file1">
  <p><button type="submit">Submit</button>
</form>
</body>
</html>
@mcho421 mcho421 changed the title Ability to disable file uploads Ability to disable file uploads with Starlette integration Aug 29, 2020
@rafalp rafalp added the decision needed Sounds like good idea, but will need closer scrutiny for final decision. label Nov 2, 2022
@rafalp
Copy link
Contributor

rafalp commented Jul 21, 2023

We could have enable_multipart or disable_multipart configuration knob on GraphQL app from asgi and wsgi modules.

@rafalp rafalp added roadmap Feature that we want to have included and removed decision needed Sounds like good idea, but will need closer scrutiny for final decision. labels Jul 21, 2023
@TMuszczekk TMuszczekk added to do and removed roadmap Feature that we want to have included labels Mar 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
to do
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@rafalp @mcho421 @TMuszczekk