This is an automated email from the ASF dual-hosted git repository.
sergehuber pushed a change to branch simplify-request-id-validation-patterns
in repository https://gitbox.apache.org/repos/asf/unomi.git
discard fefbe40ab Cover identifier validation with an integration test
discard 2a229ae5b Simplify identifier validation patterns to a single
character class
add 5edd1e9b7 Authorize the executed GraphQL operation, not the first
definition (#874)
add 503a0d690 Check roles and tenant authority after a realm login (#875)
add b6e454521 Apply the restricted-event-type gate to events submitted
over GraphQL (#870)
add f157a34db Simplify identifier validation patterns to a single
character class
add f7d6cbf65 Cover identifier validation with an integration test
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (fefbe40ab)
\
N -- N -- N refs/heads/simplify-request-id-validation-patterns
(f7d6cbf65)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
.../graphql/commands/ProcessEventsCommand.java | 28 ++-
.../auth/GraphQLServletSecurityValidator.java | 244 ++++++++++++++++-----
.../servlet/websocket/SubscriptionWebSocket.java | 8 +-
.../graphql/commands/ProcessEventsCommandTest.java | 82 +++++++
.../auth/GraphQLServletSecurityValidatorTest.java | 156 ++++++++++++-
.../websocket/SubscriptionWebSocketTest.java | 4 +-
.../itests/graphql/GraphQLServletSecurityIT.java | 64 ++++++
.../security/bypass-ambiguous-multi-operation.json | 4 +
.../graphql/security/bypass-extra-root-field.json | 5 +
.../graphql/security/bypass-fragment-spread.json | 5 +
.../security/bypass-introspection-named.json | 5 +
.../graphql/security/bypass-leading-fragment.json | 5 +
.../security/bypass-operation-name-smuggle.json | 5 +
13 files changed, 552 insertions(+), 63 deletions(-)
create mode 100644
graphql/cxs-impl/src/test/java/org/apache/unomi/graphql/commands/ProcessEventsCommandTest.java
create mode 100644
itests/src/test/resources/graphql/security/bypass-ambiguous-multi-operation.json
create mode 100644
itests/src/test/resources/graphql/security/bypass-extra-root-field.json
create mode 100644
itests/src/test/resources/graphql/security/bypass-fragment-spread.json
create mode 100644
itests/src/test/resources/graphql/security/bypass-introspection-named.json
create mode 100644
itests/src/test/resources/graphql/security/bypass-leading-fragment.json
create mode 100644
itests/src/test/resources/graphql/security/bypass-operation-name-smuggle.json
