Skip to content

Commit a2900f8

Browse files
committed
Fix nil panic in UniqueOperationNamesRule with two anonymous operations
node.Name is nil when the operation is anonymous. Use the parent AST node instead in this case. Found with go-fuzz. Commit: titanous/graphql@ab875bc
1 parent d114382 commit a2900f8

File tree

2 files changed

+13
-3
lines changed

2 files changed

+13
-3
lines changed

rules.go

+7-3
Original file line numberDiff line numberDiff line change
@@ -1517,7 +1517,7 @@ func UniqueInputFieldNamesRule(context *ValidationContext) *ValidationRuleInstan
15171517
//
15181518
// A GraphQL document is only valid if all defined operations have unique names.
15191519
func UniqueOperationNamesRule(context *ValidationContext) *ValidationRuleInstance {
1520-
knownOperationNames := map[string]*ast.Name{}
1520+
knownOperationNames := make(map[string]ast.Node)
15211521

15221522
visitorOpts := &visitor.VisitorOptions{
15231523
KindFuncMap: map[string]visitor.NamedVisitFuncs{
@@ -1528,14 +1528,18 @@ func UniqueOperationNamesRule(context *ValidationContext) *ValidationRuleInstanc
15281528
if node.Name != nil {
15291529
operationName = node.Name.Value
15301530
}
1531+
var errNode ast.Node = node
1532+
if node.Name != nil {
1533+
errNode = node.Name
1534+
}
15311535
if nameAST, ok := knownOperationNames[operationName]; ok {
15321536
reportError(
15331537
context,
15341538
fmt.Sprintf(`There can only be one operation named "%v".`, operationName),
1535-
[]ast.Node{nameAST, node.Name},
1539+
[]ast.Node{nameAST, errNode},
15361540
)
15371541
} else {
1538-
knownOperationNames[operationName] = node.Name
1542+
knownOperationNames[operationName] = errNode
15391543
}
15401544
}
15411545
return visitor.ActionSkip, nil

rules_unique_operation_names_test.go

+6
Original file line numberDiff line numberDiff line change
@@ -102,3 +102,9 @@ func TestValidate_UniqueOperationNames_MultipleOperationsOfSameNameOfDifferentTy
102102
testutil.RuleError(`There can only be one operation named "Foo".`, 2, 13, 5, 20),
103103
})
104104
}
105+
106+
func TestValidate_UniqueOperationNames_MultipleAnonymousOperations(t *testing.T) {
107+
testutil.ExpectFailsRule(t, graphql.UniqueOperationNamesRule, `{a}{b}`, []gqlerrors.FormattedError{
108+
testutil.RuleError(`There can only be one operation named "".`, 1, 1, 1, 4),
109+
})
110+
}

0 commit comments

Comments
 (0)