synapsecns/sanguine

package interceptor

import (
    "context"
    "github.com/99designs/gqlgen/graphql"
    "github.com/synapsecns/sanguine/core/dbcommon"
)

type sqlSanitizerImpl struct {
}

func (s sqlSanitizerImpl) ExtensionName() string {
    return "sqlsanitizer"
}

func (s sqlSanitizerImpl) Validate(schema graphql.ExecutableSchema) error {
    return nil
}

// SqlSanitizer is a middleware that sanitizes SQL queries.
type SqlSanitizer interface {
    graphql.ResponseInterceptor
    graphql.HandlerExtension
}

// InterceptResponse intercepts the incoming request.
func (s sqlSanitizerImpl) InterceptResponse(ctx context.Context, next graphql.ResponseHandler) *graphql.Response {
    if !graphql.HasOperationContext(ctx) {
        return next(ctx)
    }

    oc := graphql.GetOperationContext(ctx)
    // key validation is handled by schema validator already
    for key, val := range oc.Variables {
        switch marshalledVal := val.(type) {
        case string:
            oc.Variables[key] = dbcommon.MysqlRealEscapeString(marshalledVal)
        }

    }
    graphql.WithOperationContext(ctx, oc)

    return next(ctx)
}

// SqlSanitizerMiddleware returns a new SqlSanitizer middleware. This is a workaround
// until we have better support for paramaterized queries.
func SqlSanitizerMiddleware() SqlSanitizer {
    return sqlSanitizerImpl{}
}