QuerySecurityRule.php — WooCommerce 10.9.3

woocommerce / lib / packages / GraphQL / Validator / Rules / QuerySecurityRule.php

woocommerce / lib / packages / GraphQL / Validator / Rules Last commit date

QuerySecurityRule.php

185 lines

1	<?php declare(strict_types=1);
2
3	namespace Automattic\WooCommerce\Vendor\GraphQL\Validator\Rules;
4
5	use Automattic\WooCommerce\Vendor\GraphQL\Error\InvariantViolation;
6	use Automattic\WooCommerce\Vendor\GraphQL\Language\AST\FieldNode;
7	use Automattic\WooCommerce\Vendor\GraphQL\Language\AST\FragmentDefinitionNode;
8	use Automattic\WooCommerce\Vendor\GraphQL\Language\AST\FragmentSpreadNode;
9	use Automattic\WooCommerce\Vendor\GraphQL\Language\AST\InlineFragmentNode;
10	use Automattic\WooCommerce\Vendor\GraphQL\Language\AST\SelectionSetNode;
11	use Automattic\WooCommerce\Vendor\GraphQL\Language\Visitor;
12	use Automattic\WooCommerce\Vendor\GraphQL\Type\Definition\FieldDefinition;
13	use Automattic\WooCommerce\Vendor\GraphQL\Type\Definition\HasFieldsType;
14	use Automattic\WooCommerce\Vendor\GraphQL\Type\Definition\Type;
15	use Automattic\WooCommerce\Vendor\GraphQL\Type\Introspection;
16	use Automattic\WooCommerce\Vendor\GraphQL\Utils\AST;
17	use Automattic\WooCommerce\Vendor\GraphQL\Validator\QueryValidationContext;
18
19	/**
20	* @see Visitor, FieldDefinition
21	*
22	* @phpstan-import-type VisitorArray from Visitor
23	*
24	* @phpstan-type ASTAndDefs \ArrayObject<string, \ArrayObject<int, array{FieldNode, FieldDefinition\|null}>>
25	*/
26	abstract class QuerySecurityRule extends ValidationRule
27	{
28	public const DISABLED = 0;
29
30	/** @var array<string, FragmentDefinitionNode> */
31	protected array $fragments = [];
32
33	/** @throws \InvalidArgumentException */
34	protected function checkIfGreaterOrEqualToZero(string $name, int $value): void
35	{
36	if ($value < 0) {
37	throw new \InvalidArgumentException("\${$name} argument must be greater or equal to 0.");
38	}
39	}
40
41	protected function getFragment(FragmentSpreadNode $fragmentSpread): ?FragmentDefinitionNode
42	{
43	return $this->fragments[$fragmentSpread->name->value] ?? null;
44	}
45
46	/** @return array<string, FragmentDefinitionNode> */
47	protected function getFragments(): array
48	{
49	return $this->fragments;
50	}
51
52	/**
53	* @phpstan-param VisitorArray $validators
54	*
55	* @phpstan-return VisitorArray
56	*/
57	protected function invokeIfNeeded(QueryValidationContext $context, array $validators): array
58	{
59	if (! $this->isEnabled()) {
60	return [];
61	}
62
63	$this->gatherFragmentDefinition($context);
64
65	return $validators;
66	}
67
68	abstract protected function isEnabled(): bool;
69
70	protected function gatherFragmentDefinition(QueryValidationContext $context): void
71	{
72	// Gather all the fragment definition.
73	// Importantly this does not include inline fragments.
74	$definitions = $context->getDocument()->definitions;
75	foreach ($definitions as $node) {
76	if ($node instanceof FragmentDefinitionNode) {
77	$this->fragments[$node->name->value] = $node;
78	}
79	}
80	}
81
82	/**
83	* Given a selectionSet, adds all fields in that selection to
84	* the passed in map of fields, and returns it at the end.
85	*
86	* Note: This is not the same as execution's collectFields because at static
87	* time we do not know what object type will be used, so we unconditionally
88	* spread in all fragments.
89	*
90	* @see \Automattic\WooCommerce\Vendor\GraphQL\Validator\Rules\OverlappingFieldsCanBeMerged
91	*
92	* @param \ArrayObject<string, true>\|null $visitedFragmentNames
93	*
94	* @phpstan-param ASTAndDefs\|null $astAndDefs
95	*
96	* @throws \Exception
97	* @throws \ReflectionException
98	* @throws InvariantViolation
99	*
100	* @phpstan-return ASTAndDefs
101	*/
102	protected function collectFieldASTsAndDefs(
103	QueryValidationContext $context,
104	?Type $parentType,
105	SelectionSetNode $selectionSet,
106	?\ArrayObject $visitedFragmentNames = null,
107	?\ArrayObject $astAndDefs = null
108	): \ArrayObject {
109	$visitedFragmentNames ??= new \ArrayObject();
110	$astAndDefs ??= new \ArrayObject();
111
112	foreach ($selectionSet->selections as $selection) {
113	if ($selection instanceof FieldNode) {
114	$fieldName = $selection->name->value;
115
116	$fieldDef = null;
117	if ($parentType instanceof HasFieldsType) {
118	$schemaMetaFieldDef = Introspection::schemaMetaFieldDef();
119	$typeMetaFieldDef = Introspection::typeMetaFieldDef();
120	$typeNameMetaFieldDef = Introspection::typeNameMetaFieldDef();
121
122	$queryType = $context->getSchema()->getQueryType();
123
124	if ($fieldName === $schemaMetaFieldDef->name && $queryType === $parentType) {
125	$fieldDef = $schemaMetaFieldDef;
126	} elseif ($fieldName === $typeMetaFieldDef->name && $queryType === $parentType) {
127	$fieldDef = $typeMetaFieldDef;
128	} elseif ($fieldName === $typeNameMetaFieldDef->name) {
129	$fieldDef = $typeNameMetaFieldDef;
130	} elseif ($parentType->hasField($fieldName)) {
131	$fieldDef = $parentType->getField($fieldName);
132	}
133	}
134
135	$responseName = $this->getFieldName($selection);
136	$responseContext = $astAndDefs[$responseName] ??= new \ArrayObject();
137	$responseContext[] = [$selection, $fieldDef];
138	} elseif ($selection instanceof InlineFragmentNode) {
139	$typeCondition = $selection->typeCondition;
140	$fragmentParentType = $typeCondition === null
141	? $parentType
142	: AST::typeFromAST([$context->getSchema(), 'getType'], $typeCondition);
143	$astAndDefs = $this->collectFieldASTsAndDefs(
144	$context,
145	$fragmentParentType,
146	$selection->selectionSet,
147	$visitedFragmentNames,
148	$astAndDefs
149	);
150	} elseif ($selection instanceof FragmentSpreadNode) {
151	$fragName = $selection->name->value;
152
153	if (isset($visitedFragmentNames[$fragName])) {
154	continue;
155	}
156	$visitedFragmentNames[$fragName] = true;
157
158	$fragment = $context->getFragment($fragName);
159	if ($fragment === null) {
160	continue;
161	}
162
163	$astAndDefs = $this->collectFieldASTsAndDefs(
164	$context,
165	AST::typeFromAST([$context->getSchema(), 'getType'], $fragment->typeCondition),
166	$fragment->selectionSet,
167	$visitedFragmentNames,
168	$astAndDefs
169	);
170	}
171	}
172
173	return $astAndDefs;
174	}
175
176	protected function getFieldName(FieldNode $node): string
177	{
178	$fieldName = $node->name->value;
179
180	return $node->alias === null
181	? $fieldName
182	: $node->alias->value;
183	}
184	}
185