Don't put queries in the querystring

danpalmer · danpalmer · commit 58e79865bf62 · 2018-08-30T19:12:51.000+01:00
The querystring will be logged to webserver logs, so is not suitable for
sensitive data. This does not remove the ability to do queries over
GET, but does remove GraphiQL doing it by default, which is unsafe.
diff --git a/graphene_django/templates/graphene/graphiql.html b/graphene_django/templates/graphene/graphiql.html
@@ -24,41 +24,13 @@
 </head>
 <body>
   <script>
+
     // Parse the cookie value for a CSRF token
     var csrftoken;
     var cookies = ('; ' + document.cookie).split('; csrftoken=');
     if (cookies.length == 2)
       csrftoken = cookies.pop().split(';').shift();
 
-    // Collect the URL parameters
-    var parameters = {};
-    window.location.search.substr(1).split('&').forEach(function (entry) {
-      var eq = entry.indexOf('=');
-      if (eq >= 0) {
-        parameters[decodeURIComponent(entry.slice(0, eq))] =
-          decodeURIComponent(entry.slice(eq + 1));
-      }
-    });
-    // Produce a Location query string from a parameter object.
-    function locationQuery(params) {
-      return '?' + Object.keys(params).map(function (key) {
-        return encodeURIComponent(key) + '=' +
-          encodeURIComponent(params[key]);
-      }).join('&');
-    }
-    // Derive a fetch URL from the current URL, sans the GraphQL parameters.
-    var graphqlParamNames = {
-      query: true,
-      variables: true,
-      operationName: true
-    };
-    var otherParams = {};
-    for (var k in parameters) {
-      if (parameters.hasOwnProperty(k) && graphqlParamNames[k] !== true) {
-        otherParams[k] = parameters[k];
-      }
-    }
-    var fetchURL = locationQuery(otherParams);
     // Defines a GraphQL fetcher using the fetch API.
     function graphQLFetcher(graphQLParams) {
       var headers = {
@@ -68,7 +40,7 @@
       if (csrftoken) {
         headers['X-CSRFToken'] = csrftoken;
       }
-      return fetch(fetchURL, {
+      return fetch('', {
         method: 'post',
         headers: headers,
         body: JSON.stringify(graphQLParams),
@@ -83,41 +55,13 @@
         }
       });
     }
-    // When the query and variables string is edited, update the URL bar so
-    // that it can be easily shared.
-    function onEditQuery(newQuery) {
-      parameters.query = newQuery;
-      updateURL();
-    }
-    function onEditVariables(newVariables) {
-      parameters.variables = newVariables;
-      updateURL();
-    }
-    function onEditOperationName(newOperationName) {
-      parameters.operationName = newOperationName;
-      updateURL();
-    }
-    function updateURL() {
-      history.replaceState(null, null, locationQuery(parameters));
-    }
+
     // Render <GraphiQL /> into the body.
     ReactDOM.render(
-      React.createElement(GraphiQL, {
-        fetcher: graphQLFetcher,
-        onEditQuery: onEditQuery,
-        onEditVariables: onEditVariables,
-        onEditOperationName: onEditOperationName,
-        query: '{{ query|escapejs }}',
-        response: '{{ result|escapejs }}',
-        {% if variables %}
-        variables: '{{ variables|escapejs }}',
-        {% endif %}
-        {% if operation_name %}
-        operationName: '{{ operation_name|escapejs }}',
-        {% endif %}
-      }),
+      React.createElement(GraphiQL, {fetcher: graphQLFetcher}),
       document.body
     );
+
   </script>
 </body>
 </html>
diff --git a/graphene_django/views.py b/graphene_django/views.py
@@ -124,6 +124,11 @@ def dispatch(self, request, *args, **kwargs):
             data = self.parse_body(request)
             show_graphiql = self.graphiql and self.can_display_graphiql(request, data)
 
+            if show_graphiql:
+                return self.render_graphiql(
+                    request, graphiql_version=self.graphiql_version
+                )
+
             if self.batch:
                 responses = [self.get_response(request, entry) for entry in data]
                 result = "[{}]".format(
@@ -137,19 +142,6 @@ def dispatch(self, request, *args, **kwargs):
             else:
                 result, status_code = self.get_response(request, data, show_graphiql)
 
-            if show_graphiql:
-                query, variables, operation_name, id = self.get_graphql_params(
-                    request, data
-                )
-                return self.render_graphiql(
-                    request,
-                    graphiql_version=self.graphiql_version,
-                    query=query or "",
-                    variables=json.dumps(variables) or "",
-                    operation_name=operation_name or "",
-                    result=result or "",
-                )
-
             return HttpResponse(
                 status=status_code, content=result, content_type="application/json"
             )
