From 896e4cfaa6e2235e686cc642ce235d080d8961d9 Mon Sep 17 00:00:00 2001 From: Aaryamann Challani <43716372+rymnc@users.noreply.github.com> Date: Mon, 25 Nov 2024 16:19:22 +0530 Subject: [PATCH] fix(graphql_playground): use graphiql instead (#2446) ## Linked Issues/PRs - none ## Description The graphql-playground is well-outdated, with the last update being 2y ago. This PR switches it out for graphiql which is more recently maintained. I did this because the tooltips don't dissapear on the playground with latest versions of chrome/arc due to a deprecated event handler on the DOM. see https://github.com/graphql/graphql-playground/issues/1429 image ## Checklist - [x] Breaking changes are clearly marked as such in the PR description and changelog - [x] New behavior is reflected in tests - [x] [The specification](https://github.com/FuelLabs/fuel-specs/) matches the implemented behavior (link update PR if changes are needed) ### Before requesting review - [x] I have reviewed the code myself - [x] I have created follow-up issues caused by this PR and linked them here ### After merging, notify other teams [Add or remove entries as needed] - [ ] [Rust SDK](https://github.com/FuelLabs/fuels-rs/) - [ ] [Sway compiler](https://github.com/FuelLabs/sway/) - [ ] [Platform documentation](https://github.com/FuelLabs/devrel-requests/issues/new?assignees=&labels=new+request&projects=&template=NEW-REQUEST.yml&title=%5BRequest%5D%3A+) (for out-of-organization contributors, the person merging the PR will do this) - [ ] Someone else? --- CHANGELOG.md | 3 +- Cargo.lock | 49 +++++++++++++++++++ bin/fuel-core/src/cli/run/graphql.rs | 2 +- crates/fuel-core/Cargo.toml | 2 +- .../fuel-core/src/graphql_api/api_service.rs | 30 ++++++++---- 5 files changed, 72 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fdd6424972a..17329a646aa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -40,9 +40,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/). #### Breaking - [2389](https://github.com/FuelLabs/fuel-core/pull/2258): Updated the `messageProof` GraphQL schema to return a non-nullable `MessageProof`. - -#### Breaking - [2154](https://github.com/FuelLabs/fuel-core/pull/2154): Transaction graphql endpoints use `TransactionType` instead of `fuel_tx::Transaction`. +- [2446](https://github.com/FuelLabs/fuel-core/pull/2446): Use graphiql instead of graphql-playground due to known vulnerability and stale development. ## [Version 0.40.0] diff --git a/Cargo.lock b/Cargo.lock index a3d5b110deb..77cc703905c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -352,6 +352,7 @@ dependencies = [ "fnv", "futures-timer", "futures-util", + "handlebars", "http 1.1.0", "indexmap 2.6.0", "mime", @@ -4401,6 +4402,20 @@ dependencies = [ "crunchy", ] +[[package]] +name = "handlebars" +version = "5.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d08485b96a0e6393e9e4d1b8d48cf74ad6c063cd905eb33f42c1ce3f0377539b" +dependencies = [ + "log", + "pest", + "pest_derive", + "serde", + "serde_json", + "thiserror 1.0.69", +] + [[package]] name = "hash32" version = "0.2.1" @@ -6940,6 +6955,40 @@ dependencies = [ "ucd-trie", ] +[[package]] +name = "pest_derive" +version = "2.7.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2a548d2beca6773b1c244554d36fcf8548a8a58e74156968211567250e48e49a" +dependencies = [ + "pest", + "pest_generator", +] + +[[package]] +name = "pest_generator" +version = "2.7.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3c93a82e8d145725dcbaf44e5ea887c8a869efdcc28706df2d08c69e17077183" +dependencies = [ + "pest", + "pest_meta", + "proc-macro2", + "quote", + "syn 2.0.87", +] + +[[package]] +name = "pest_meta" +version = "2.7.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a941429fea7e08bedec25e4f6785b6ffaacc6b755da98df5ef3e7dcf4a124c4f" +dependencies = [ + "once_cell", + "pest", + "sha2 0.10.8", +] + [[package]] name = "petgraph" version = "0.6.5" diff --git a/bin/fuel-core/src/cli/run/graphql.rs b/bin/fuel-core/src/cli/run/graphql.rs index 5816b2ecbc0..4abce8922a1 100644 --- a/bin/fuel-core/src/cli/run/graphql.rs +++ b/bin/fuel-core/src/cli/run/graphql.rs @@ -31,7 +31,7 @@ pub struct GraphQLArgs { pub graphql_max_complexity: usize, /// The max recursive depth of GraphQL queries. - #[clap(long = "graphql-max-recursive-depth", default_value = "16", env)] + #[clap(long = "graphql-max-recursive-depth", default_value = "24", env)] pub graphql_max_recursive_depth: usize, /// The max resolver recursive depth of GraphQL queries. diff --git a/crates/fuel-core/Cargo.toml b/crates/fuel-core/Cargo.toml index cac6a58150b..8e3230df1fc 100644 --- a/crates/fuel-core/Cargo.toml +++ b/crates/fuel-core/Cargo.toml @@ -13,7 +13,7 @@ version = { workspace = true } [dependencies] anyhow = { workspace = true } async-graphql = { version = "7.0.11", features = [ - "playground", + "graphiql", "tracing", ], default-features = false } async-graphql-value = "7.0.11" diff --git a/crates/fuel-core/src/graphql_api/api_service.rs b/crates/fuel-core/src/graphql_api/api_service.rs index e9a1411085a..aeda75b4518 100644 --- a/crates/fuel-core/src/graphql_api/api_service.rs +++ b/crates/fuel-core/src/graphql_api/api_service.rs @@ -26,10 +26,7 @@ use crate::{ }, }; use async_graphql::{ - http::{ - playground_source, - GraphQLPlaygroundConfig, - }, + http::GraphiQLSource, Request, Response, }; @@ -278,16 +275,22 @@ where .extension(ViewExtension::new()) .finish(); + let graphql_endpoint = "/v1/graphql"; + let graphql_subscription_endpoint = "/v1/graphql-sub"; + + let graphql_playground = + || render_graphql_playground(graphql_endpoint, graphql_subscription_endpoint); + let router = Router::new() .route("/v1/playground", get(graphql_playground)) .route( - "/v1/graphql", + graphql_endpoint, post(graphql_handler) .layer(ConcurrencyLimitLayer::new(concurrency_limit)) .options(ok), ) .route( - "/v1/graphql-sub", + graphql_subscription_endpoint, post(graphql_subscription_handler).options(ok), ) .route("/v1/metrics", get(metrics)) @@ -325,10 +328,17 @@ where )) } -async fn graphql_playground() -> impl IntoResponse { - Html(playground_source(GraphQLPlaygroundConfig::new( - "/v1/graphql", - ))) +async fn render_graphql_playground( + endpoint: &str, + subscription_endpoint: &str, +) -> impl IntoResponse { + Html( + GraphiQLSource::build() + .endpoint(endpoint) + .subscription_endpoint(subscription_endpoint) + .title("Fuel Graphql Playground") + .finish(), + ) } async fn health() -> Json {