Skip to content

validate oneOf input objects in lists coerced from non-array values - #4494

Open
nab-iha3 wants to merge 1 commit into
graphql-java:masterfrom
nab-iha3:oneof-list-coercion-validation
Open

nab-iha3 wants to merge 1 commit into
graphql-java:masterfrom
nab-iha3:oneof-list-coercion-validation

Conversation

@nab-iha3

Copy link
Copy Markdown
Contributor

with input OneOf @oneOf { a: Int, b: Int } and type Query { q(oneofs: [OneOf]): Boolean }:

{ q(oneofs: {a: null}) }
=> {"data": {"q": true}}    (no errors, the fetcher received [{a: null}])

ValuesResolverOneOfValidation.validateOneOfInputTypes only walks list elements when the argument AST node is an ArrayValue. A single object literal coerced into a list per the spec's list input coercion is never checked, and neither is a list resolved from a variable default, query ($v: [OneOf] = [{a: null}]) { q(oneofs: $v) }, because variable defaults are coerced by literalToInternalValue which does no oneOf validation. Document validation doesn't reject these either, ValidationUtil only enforces the key count. Lists sent through the variables map are unaffected, they are already checked per element in ValuesResolverConversion.

The fix validates the coerced list elements directly when the argument value is not an ArrayValue, so these inputs now fail with the same OneOfNullValueException / OneOfTooManyKeysException as their array-literal equivalents.

@github-actions

Copy link
Copy Markdown
Contributor

Test Report

Test Results

Java Version Total Passed Failed Errors Skipped
Java 11 5967 (+5 🟢) 5911 (+5 🟢) 0 (±0) 0 (±0) 56 (±0)
Java 17 5967 (+5 🟢) 5910 (+5 🟢) 0 (±0) 0 (±0) 57 (±0)
Java 21 5967 (+5 🟢) 5910 (+5 🟢) 0 (±0) 0 (±0) 57 (±0)
Java 25 5967 (+5 🟢) 5910 (+5 🟢) 0 (±0) 0 (±0) 57 (±0)
jcstress 32 (±0) 32 (±0) 0 (±0) 0 (±0) 0 (±0)
Total 23900 (+20 🟢) 23673 (+20 🟢) 0 (±0) 0 (±0) 227 (±0)

Code Coverage (Java 25)

Metric Covered Missed Coverage vs Master
Lines 30145 3118 90.6% ±0.0%
Branches 8840 1520 85.3% ±0.0%
Methods 8048 1207 87.0% ±0.0%

Changed Class Coverage (1 class)

Class Line Branch Method
g.e.ValuesResolverOneOfValidation +0.9% 🟢 +0.4% 🟢 ±0.0%

Full HTML report: build artifact jacoco-html-report

Updated: 2026-10-11 18:41:38 UTC

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant