diff --git a/execute_query.go b/execute_query.go index 5078e09..2309102 100644 --- a/execute_query.go +++ b/execute_query.go @@ -8,6 +8,7 @@ import ( "fmt" "io" "net/http" + "os" "time" "unicode/utf8" @@ -16,6 +17,8 @@ import ( libpack_logger "github.com/lukaszraczylo/go-simple-graphql/logging" ) +// Size limit constants are defined in query.go + // min returns the smaller of two integers func min(a, b int) int { if a < b { @@ -32,23 +35,38 @@ func max(a, b int) int { return b } -var ( - // Shared HTTP transport with optimized settings - defaultTransport = &http.Transport{ - MaxIdleConns: 100, - MaxIdleConnsPerHost: 100, - IdleConnTimeout: 90 * time.Second, - DisableCompression: true, // Disable automatic request compression to prevent "trailing garbage" errors - ForceAttemptHTTP2: true, - TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // Skip TLS verification for test environments +// getDefaultClient creates a default HTTP client with optimized settings +// This is called dynamically to ensure environment variables are read at runtime +func getDefaultClient() *http.Client { + return &http.Client{ + Transport: &http.Transport{ + MaxIdleConns: 100, + MaxIdleConnsPerHost: 100, + IdleConnTimeout: 90 * time.Second, + DisableCompression: true, // Disable automatic request compression to prevent "trailing garbage" errors + ForceAttemptHTTP2: true, + TLSClientConfig: getTLSConfig(), + }, + Timeout: 30 * time.Second, + } +} + +// getTLSConfig returns TLS configuration based on environment settings +// By default, TLS verification is enabled for security. +// Set GRAPHQL_INSECURE_SKIP_VERIFY=true to disable verification (NOT RECOMMENDED for production) +func getTLSConfig() *tls.Config { + skipVerify := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") == "true" + + if skipVerify { + // Log warning when running in insecure mode + fmt.Fprintf(os.Stderr, "WARNING: TLS certificate verification is disabled. This is insecure and should not be used in production.\n") } - // Shared HTTP client with timeouts - defaultClient = &http.Client{ - Transport: defaultTransport, - Timeout: 30 * time.Second, + return &tls.Config{ + InsecureSkipVerify: skipVerify, + MinVersion: tls.VersionTLS12, // Enforce minimum TLS 1.2 for security } -) +} func (qe *QueryExecutor) executeQuery() ([]byte, error) { // Reuse buffer from pool to avoid allocations @@ -58,7 +76,10 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) { buf.Write(qe.Query) - httpRequest, err := http.NewRequest(http.MethodPost, qe.endpoint, nil) + qe.mu.RLock() + endpoint := qe.endpoint + qe.mu.RUnlock() + httpRequest, err := http.NewRequest(http.MethodPost, endpoint, nil) if err != nil { qe.Logger.Error(&libpack_logger.LogMessage{ Message: "Can't create HTTP request", @@ -82,7 +103,9 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) { retriesMax := 1 if qe.Retries { + qe.mu.RLock() retriesMax = qe.retries_number + qe.mu.RUnlock() } var queryResult queryResults @@ -100,8 +123,8 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) { "body_size": len(requestBody), "contains_jsonQuery": bytes.Contains(requestBody, []byte(`"jsonQuery"`)), "contains_base64": bytes.Contains(requestBody, []byte("eyJ")), - "first_100_chars": string(requestBody[:min(100, len(requestBody))]), - "last_50_chars": string(requestBody[max(0, len(requestBody)-50):]), + "first_100_chars": sanitizeForLogging(string(requestBody[:min(100, len(requestBody))])), + "last_50_chars": sanitizeForLogging(string(requestBody[max(0, len(requestBody)-50):])), "is_valid_utf8": utf8.Valid(requestBody), "has_null_bytes": bytes.Contains(requestBody, []byte{0}), "has_control_chars": hasControlChars(requestBody), @@ -132,9 +155,11 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) { }) // Use default client if custom client is not set + qe.mu.RLock() client := qe.client + qe.mu.RUnlock() if client == nil { - client = defaultClient + client = getDefaultClient() } httpResponse, err := client.Do(httpRequest) if err != nil { @@ -159,16 +184,32 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) { }, }) - // First, read the entire response body into a buffer + // Check Content-Length header if available for early size validation + if contentLength := httpResponse.ContentLength; contentLength > 0 && contentLength > MaxResponseSize { + return fmt.Errorf("response size %d exceeds maximum allowed size of %d bytes", contentLength, MaxResponseSize) + } + + // First, read the entire response body into a buffer with size limit rawBuf := bufferPool.Get().(*bytes.Buffer) rawBuf.Reset() defer bufferPool.Put(rawBuf) - _, err = io.Copy(rawBuf, httpResponse.Body) + // Use LimitedReader to prevent reading more than MaxResponseSize + limitedReader := &io.LimitedReader{ + R: httpResponse.Body, + N: MaxResponseSize + 1, // Read one extra byte to detect oversized responses + } + + n, err := io.Copy(rawBuf, limitedReader) if err != nil { return fmt.Errorf("error reading HTTP response body: %w", err) } + // Check if response exceeded size limit + if n > MaxResponseSize { + return fmt.Errorf("response size exceeds maximum allowed size of %d bytes", MaxResponseSize) + } + rawData := rawBuf.Bytes() qe.Logger.Debug(&libpack_logger.LogMessage{ Message: "Read raw response data", @@ -341,7 +382,11 @@ func (qe *QueryExecutor) executeQuery() ([]byte, error) { }), retry.Attempts(uint(retriesMax)), retry.DelayType(retry.BackOffDelay), - retry.Delay(time.Duration(qe.retries_delay)), + retry.Delay(func() time.Duration { + qe.mu.RLock() + defer qe.mu.RUnlock() + return qe.retries_delay + }()), retry.MaxDelay(10*time.Second), retry.LastErrorOnly(true), ) diff --git a/http.go b/http.go index 81b7d1a..82e67e3 100644 --- a/http.go +++ b/http.go @@ -2,7 +2,9 @@ package gql import ( "crypto/tls" + "fmt" "net/http" + "os" "strings" "time" @@ -10,7 +12,7 @@ import ( "golang.org/x/net/http2" ) -func (b *BaseClient) createHttpClient() (http_client *http.Client) { +func (b *BaseClient) createHttpClient() (*http.Client, error) { // Optimized connection pool settings for better performance httpTransport := &http.Transport{ MaxIdleConns: 100, // Reduced from 512 @@ -24,7 +26,14 @@ func (b *BaseClient) createHttpClient() (http_client *http.Client) { ReadBufferSize: 4096, // Optimize buffer size } - if strings.HasPrefix(b.endpoint, "http://") { + var http_client *http.Client + + // Protect read of endpoint field + b.mu.RLock() + endpoint := b.endpoint + b.mu.RUnlock() + + if strings.HasPrefix(endpoint, "http://") { http_client = &http.Client{ Timeout: 30 * time.Second, // Increased for better reliability Transport: httpTransport, @@ -36,10 +45,12 @@ func (b *BaseClient) createHttpClient() (http_client *http.Client) { Message: "Using HTTP/1.1 over http", Pairs: nil, }) - } else if strings.HasPrefix(b.endpoint, "https://") { - tlsClientConfig := &tls.Config{} - if strings.HasPrefix(b.endpoint, "https://") { - tlsClientConfig.InsecureSkipVerify = true + } else if strings.HasPrefix(endpoint, "https://") { + tlsClientConfig := getHTTPClientTLSConfig() + if strings.HasPrefix(endpoint, "https://") && tlsClientConfig.InsecureSkipVerify { + b.Logger.Warning(&libpack_logger.LogMessage{ + Message: "TLS certificate verification is disabled. This is insecure and should not be used in production.", + }) } http2Transport := &http2.Transport{ AllowHTTP: true, @@ -64,7 +75,25 @@ func (b *BaseClient) createHttpClient() (http_client *http.Client) { b.Logger.Critical(&libpack_logger.LogMessage{ Message: "Invalid endpoint - neither http or https", }) - return nil + // Return error instead of nil to prevent nil pointer dereference + return nil, fmt.Errorf("invalid endpoint: %s - must start with http:// or https://", endpoint) + } + return http_client, nil +} + +// getHTTPClientTLSConfig returns TLS configuration for HTTP client +// By default, TLS verification is enabled for security. +// Set GRAPHQL_INSECURE_SKIP_VERIFY=true to disable verification (NOT RECOMMENDED for production) +func getHTTPClientTLSConfig() *tls.Config { + skipVerify := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") == "true" + + if skipVerify { + // Log warning to stderr when running in insecure mode + fmt.Fprintf(os.Stderr, "WARNING: TLS certificate verification is disabled. This is insecure and should not be used in production.\n") + } + + return &tls.Config{ + InsecureSkipVerify: skipVerify, + MinVersion: tls.VersionTLS12, // Enforce minimum TLS 1.2 for security } - return http_client } diff --git a/http_test.go b/http_test.go index de7dc5a..69dd080 100644 --- a/http_test.go +++ b/http_test.go @@ -2,6 +2,7 @@ package gql import ( "net/http" + "os" "testing" "time" @@ -13,7 +14,8 @@ func (suite *Tests) TestBaseClient_createHttpClient() { client := NewConnection() client.SetEndpoint("http://example.com/graphql") - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.NoError(err) assert.NotNil(httpClient) assert.Equal(30*time.Second, httpClient.Timeout) assert.NotNil(httpClient.Transport) @@ -33,10 +35,22 @@ func (suite *Tests) TestBaseClient_createHttpClient() { }) suite.T().Run("should create HTTP/2 client for https endpoints", func(t *testing.T) { + // Set environment variable for test to skip TLS verification + oldValue := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") + os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", "true") + t.Cleanup(func() { + if oldValue != "" { + os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", oldValue) + } else { + os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY") + } + }) + client := NewConnection() client.SetEndpoint("https://example.com/graphql") - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.NoError(err) assert.NotNil(httpClient) assert.Equal(30*time.Second, httpClient.Timeout) assert.NotNil(httpClient.Transport) @@ -56,7 +70,9 @@ func (suite *Tests) TestBaseClient_createHttpClient() { client := NewConnection() client.SetEndpoint("ftp://example.com/graphql") - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.Error(err) + assert.Contains(err.Error(), "invalid endpoint") assert.Nil(httpClient) }) @@ -64,21 +80,24 @@ func (suite *Tests) TestBaseClient_createHttpClient() { client := NewConnection() client.SetEndpoint("http://example.com/graphql") - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.NoError(err) assert.NotNil(httpClient) assert.NotNil(httpClient.CheckRedirect) // Test redirect policy req, _ := http.NewRequest("GET", "http://example.com", nil) - err := httpClient.CheckRedirect(req, []*http.Request{}) - assert.Equal(http.ErrUseLastResponse, err) + err2 := httpClient.CheckRedirect(req, []*http.Request{}) + assert.Equal(http.ErrUseLastResponse, err2) }) suite.T().Run("should handle empty endpoint", func(t *testing.T) { client := NewConnection() client.SetEndpoint("") - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.Error(err) + assert.Contains(err.Error(), "invalid endpoint") assert.Nil(httpClient) }) @@ -86,9 +105,35 @@ func (suite *Tests) TestBaseClient_createHttpClient() { client := NewConnection() client.SetEndpoint("example.com/graphql") - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.Error(err) + assert.Contains(err.Error(), "invalid endpoint") assert.Nil(httpClient) }) + + suite.T().Run("should enable TLS verification by default for https endpoints", func(t *testing.T) { + // Ensure the environment variable is not set + oldValue := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") + os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY") + t.Cleanup(func() { + if oldValue != "" { + os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", oldValue) + } + }) + + client := NewConnection() + client.SetEndpoint("https://example.com/graphql") + + httpClient, err := client.createHttpClient() + assert.NoError(err) + assert.NotNil(httpClient) + + // Check that TLS verification is enabled by default + transport, ok := httpClient.Transport.(*http2.Transport) + assert.True(ok) + assert.NotNil(transport.TLSClientConfig) + assert.False(transport.TLSClientConfig.InsecureSkipVerify) // Should be false by default + }) } func (suite *Tests) TestBaseClient_createHttpClient_transportSettings() { @@ -96,7 +141,9 @@ func (suite *Tests) TestBaseClient_createHttpClient_transportSettings() { client := NewConnection() client.SetEndpoint("http://example.com/graphql") - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.NoError(err) + assert.NotNil(httpClient) transport := httpClient.Transport.(*http.Transport) // Verify all transport settings @@ -112,10 +159,23 @@ func (suite *Tests) TestBaseClient_createHttpClient_transportSettings() { }) suite.T().Run("should configure HTTP/2 transport correctly", func(t *testing.T) { + // Set environment variable for test to skip TLS verification + oldValue := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") + os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", "true") + t.Cleanup(func() { + if oldValue != "" { + os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", oldValue) + } else { + os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY") + } + }) + client := NewConnection() client.SetEndpoint("https://example.com/graphql") - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.NoError(err) + assert.NotNil(httpClient) transport := httpClient.Transport.(*http2.Transport) // Verify all HTTP/2 transport settings @@ -135,17 +195,30 @@ func (suite *Tests) TestBaseClient_createHttpClient_logging() { // This test verifies that the function runs without error // The actual logging is tested indirectly through the logger tests - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.NoError(err) assert.NotNil(httpClient) }) suite.T().Run("should log HTTP/2 usage", func(t *testing.T) { + // Set environment variable for test to skip TLS verification + oldValue := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") + os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", "true") + t.Cleanup(func() { + if oldValue != "" { + os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", oldValue) + } else { + os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY") + } + }) + client := NewConnection() client.SetEndpoint("https://example.com/graphql") // This test verifies that the function runs without error // The actual logging is tested indirectly through the logger tests - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.NoError(err) assert.NotNil(httpClient) }) @@ -155,7 +228,9 @@ func (suite *Tests) TestBaseClient_createHttpClient_logging() { // This test verifies that the function runs without error // and returns nil for invalid endpoints (Critical() won't exit in tests) - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.Error(err) + assert.Contains(err.Error(), "invalid endpoint") assert.Nil(httpClient) }) } diff --git a/json_encoding_test.go b/json_encoding_test.go index 4b17b28..576aedf 100644 --- a/json_encoding_test.go +++ b/json_encoding_test.go @@ -10,6 +10,7 @@ import ( // TestQueryJSONEncoding verifies that the Query struct serializes correctly // without including the JsonQuery field, preventing "Trailing garbage" errors func TestQueryJSONEncoding(t *testing.T) { + t.Parallel() assert := assertions.New(t) client := CreateTestClient() @@ -47,6 +48,7 @@ func TestQueryJSONEncoding(t *testing.T) { // TestQueryJSONEncodingPreventsTrailingGarbage ensures the fix prevents the specific error func TestQueryJSONEncodingPreventsTrailingGarbage(t *testing.T) { + t.Parallel() assert := assertions.New(t) client := CreateTestClient() diff --git a/main.go b/main.go index aad8dd3..696d863 100644 --- a/main.go +++ b/main.go @@ -1,6 +1,7 @@ package gql import ( + "fmt" "net/http" "time" @@ -40,7 +41,18 @@ func NewConnection() (b *BaseClient) { retries_number: envutil.GetInt("GRAPHQL_RETRIES_NUMBER", 3), minify_queries: envutil.GetBool("GRAPHQL_MINIFY_QUERIES", true), // Default: enabled for production efficiency } - b.client = b.createHttpClient() + client, err := b.createHttpClient() + if err != nil { + b.Logger.Critical(&logging.LogMessage{ + Message: "Failed to create HTTP client", + Pairs: map[string]interface{}{ + "error": err.Error(), + }, + }) + // For backward compatibility, we'll still return the client but it won't work + return b + } + b.client = client b.Logger.Debug(&logging.LogMessage{ Message: "Created new GraphQL client connection", Pairs: map[string]interface{}{ @@ -51,21 +63,46 @@ func NewConnection() (b *BaseClient) { } func (b *BaseClient) SetEndpoint(endpoint string) { + b.mu.Lock() + defer b.mu.Unlock() b.endpoint = endpoint } -func (b *BaseClient) SetOutput(responseType string) { - // allowed are byte, string, mapstring - // check if responseType is allowed - // TODO: implement +func (b *BaseClient) SetOutput(responseType string) error { + // Validate responseType - allowed values are "byte", "string", "mapstring" + allowedTypes := map[string]bool{ + "byte": true, + "string": true, + "mapstring": true, + } + + if !allowedTypes[responseType] { + return fmt.Errorf("invalid response type: %s. Allowed values are: byte, string, mapstring", responseType) + } + + b.mu.Lock() + defer b.mu.Unlock() b.responseType = responseType + + b.Logger.Debug(&logging.LogMessage{ + Message: "Response type updated", + Pairs: map[string]interface{}{ + "response_type": responseType, + }, + }) + + return nil } func (b *BaseClient) SetHTTPClient(client *http.Client) { + b.mu.Lock() + defer b.mu.Unlock() b.client = client } func (b *BaseClient) SetQueryMinification(enabled bool) { + b.mu.Lock() + defer b.mu.Unlock() b.minify_queries = enabled b.Logger.Debug(&logging.LogMessage{ Message: "GraphQL query minification setting updated", diff --git a/query.go b/query.go index 90a0ac6..6ae4e6b 100644 --- a/query.go +++ b/query.go @@ -10,6 +10,13 @@ import ( libpack_logger "github.com/lukaszraczylo/go-simple-graphql/logging" ) +// Size limit constants for security +const ( + MaxQuerySize = 100 * 1024 // 100KB max query size + MaxVariableSize = 10 * 1024 // 10KB max variables size + MaxResponseSize = 10 * 1024 * 1024 // 10MB max response size +) + // minifyGraphQLQuery removes unnecessary whitespace from GraphQL queries while preserving string literals func minifyGraphQLQuery(query string) string { if query == "" { @@ -238,7 +245,10 @@ func (b *BaseClient) compileQuery(queryPartials ...any) *Query { // Apply query minification if enabled (default: true) finalQuery := query - if b.minify_queries { + b.mu.RLock() + minifyEnabled := b.minify_queries + b.mu.RUnlock() + if minifyEnabled { originalSize := len(query) minifiedQuery := minifyGraphQLQuery(query) minifiedSize := len(minifiedQuery) @@ -268,9 +278,36 @@ func (b *BaseClient) compileQuery(queryPartials ...any) *Query { } func (b *BaseClient) Query(query string, variables map[string]interface{}, headers map[string]interface{}) (any, error) { + // Validate query size limit + if len(query) > MaxQuerySize { + b.Logger.Error(&libpack_logger.LogMessage{ + Message: "Query exceeds maximum size limit", + Pairs: map[string]interface{}{ + "query_size": len(query), + "max_size": MaxQuerySize, + }, + }) + return nil, fmt.Errorf("query size %d exceeds maximum allowed size of %d bytes", len(query), MaxQuerySize) + } + // Process flags before compilation to avoid recompilation enableCache, enableRetries, cleanedVariables := processFlags(variables, headers) + // Validate variables size limit + if cleanedVariables != nil { + variablesJSON, err := json.Marshal(cleanedVariables) + if err == nil && len(variablesJSON) > MaxVariableSize { + b.Logger.Error(&libpack_logger.LogMessage{ + Message: "Variables exceed maximum size limit", + Pairs: map[string]interface{}{ + "variables_size": len(variablesJSON), + "max_size": MaxVariableSize, + }, + }) + return nil, fmt.Errorf("variables size %d exceeds maximum allowed size of %d bytes", len(variablesJSON), MaxVariableSize) + } + } + // Compile query once with cleaned variables compiledQuery := b.compileQuery(query, cleanedVariables) if compiledQuery == nil || compiledQuery.JsonQuery == nil { @@ -282,11 +319,14 @@ func (b *BaseClient) Query(query string, variables map[string]interface{}, heade } b.Logger.Debug(&libpack_logger.LogMessage{ Message: "Compiled query", - Pairs: map[string]interface{}{"query": compiledQuery}, + Pairs: map[string]interface{}{"query": sanitizeForLogging(compiledQuery.Query)}, }) var queryHash string - if (enableCache || b.cache_global) && strutil.HasPrefix(compiledQuery.Query, "query") { + b.mu.RLock() + cacheGlobal := b.cache_global + b.mu.RUnlock() + if (enableCache || cacheGlobal) && strutil.HasPrefix(compiledQuery.Query, "query") { b.Logger.Debug(&libpack_logger.LogMessage{ Message: "Cache enabled", Pairs: nil, @@ -295,13 +335,13 @@ func (b *BaseClient) Query(query string, variables map[string]interface{}, heade if cachedValue := b.cacheLookup(queryHash); cachedValue != nil { b.Logger.Debug(&libpack_logger.LogMessage{ Message: "Cache hit", - Pairs: map[string]interface{}{"query": compiledQuery}, + Pairs: map[string]interface{}{"query_hash": queryHash}, }) return b.decodeResponse(cachedValue) } b.Logger.Debug(&libpack_logger.LogMessage{ Message: "Cache miss", - Pairs: map[string]interface{}{"query": compiledQuery}, + Pairs: map[string]interface{}{"query_hash": queryHash}, }) } @@ -315,7 +355,11 @@ func (b *BaseClient) Query(query string, variables map[string]interface{}, heade } return "no-cache" }(), - Retries: enableRetries || b.retries_enable, + Retries: func() bool { + b.mu.RLock() + defer b.mu.RUnlock() + return enableRetries || b.retries_enable + }(), } rv, err := q.executeQuery() diff --git a/query_minification_test.go b/query_minification_test.go index 528cf59..0821f2c 100644 --- a/query_minification_test.go +++ b/query_minification_test.go @@ -8,6 +8,7 @@ import ( ) func TestMinifyGraphQLQuery(t *testing.T) { + t.Parallel() assert := assertions.New(t) tests := []struct { @@ -131,6 +132,7 @@ func TestMinifyGraphQLQuery(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { + t.Parallel() result := minifyGraphQLQuery(tt.input) assert.Equal(tt.expected, result, "Minified query should match expected output") @@ -150,6 +152,7 @@ func TestMinifyGraphQLQuery(t *testing.T) { } func TestMinifyGraphQLQuerySizeReduction(t *testing.T) { + t.Parallel() assert := assertions.New(t) // Test with a heavily formatted query @@ -208,9 +211,11 @@ func TestMinifyGraphQLQuerySizeReduction(t *testing.T) { } func TestBaseClientQueryMinification(t *testing.T) { + t.Parallel() assert := assertions.New(t) t.Run("should_minify_queries_by_default", func(t *testing.T) { + t.Parallel() client := CreateTestClient() // Verify minification is enabled by default @@ -233,6 +238,7 @@ func TestBaseClientQueryMinification(t *testing.T) { }) t.Run("should_respect_minification_disabled", func(t *testing.T) { + t.Parallel() client := CreateTestClient() client.SetQueryMinification(false) @@ -254,6 +260,7 @@ func TestBaseClientQueryMinification(t *testing.T) { }) t.Run("should_handle_string_literals_correctly", func(t *testing.T) { + t.Parallel() client := CreateTestClient() query := `mutation test($value: String!) { @@ -278,6 +285,7 @@ func TestBaseClientQueryMinification(t *testing.T) { }) t.Run("should_demonstrate_size_reduction_with_production_case", func(t *testing.T) { + t.Parallel() client := CreateTestClient() // Use the production case from trailing garbage test @@ -324,6 +332,7 @@ func TestBaseClientQueryMinification(t *testing.T) { } func TestIsAlphaNumeric(t *testing.T) { + t.Parallel() assert := assertions.New(t) tests := []struct { @@ -351,6 +360,7 @@ func TestIsAlphaNumeric(t *testing.T) { for _, tt := range tests { t.Run(string(tt.char), func(t *testing.T) { + t.Parallel() result := isAlphaNumeric(tt.char) assert.Equal(tt.expected, result, "isAlphaNumeric should correctly identify character type") }) @@ -358,9 +368,11 @@ func TestIsAlphaNumeric(t *testing.T) { } func TestQueryMinificationEnvironmentVariable(t *testing.T) { + t.Parallel() assert := assertions.New(t) t.Run("should_respect_GRAPHQL_MINIFY_QUERIES_env_var", func(t *testing.T) { + t.Parallel() // This test would require setting environment variables // For now, we'll test the default behavior client := NewConnection() @@ -371,19 +383,23 @@ func TestQueryMinificationEnvironmentVariable(t *testing.T) { } func TestQueryMinificationEdgeCases(t *testing.T) { + t.Parallel() assert := assertions.New(t) t.Run("should_handle_empty_query", func(t *testing.T) { + t.Parallel() result := minifyGraphQLQuery("") assert.Equal("", result, "Empty query should remain empty") }) t.Run("should_handle_query_with_only_whitespace", func(t *testing.T) { + t.Parallel() result := minifyGraphQLQuery(" \n\t \n ") assert.Equal("", result, "Query with only whitespace should become empty") }) t.Run("should_handle_nested_quotes", func(t *testing.T) { + t.Parallel() query := `mutation test { insert_test(value: "String with \"nested quotes\" and 'mixed' quotes") { id @@ -395,6 +411,7 @@ func TestQueryMinificationEdgeCases(t *testing.T) { }) t.Run("should_preserve_spaces_between_keywords", func(t *testing.T) { + t.Parallel() query := `query test($var: String!) { field(where: {id: {_eq: $var}}) { id diff --git a/request_compression_test.go b/request_compression_test.go index 59a0f68..ac30d7b 100644 --- a/request_compression_test.go +++ b/request_compression_test.go @@ -71,7 +71,8 @@ func (suite *RequestCompressionTestSuite) TestRequestCompression() { client.endpoint = endpoint // Create HTTP client using the same logic as the library - httpClient := client.createHttpClient() + httpClient, err := client.createHttpClient() + assert.NoError(err, "HTTP client should be created without error") assert.NotNil(httpClient, "HTTP client should be created") // Verify transport settings diff --git a/sanitize.go b/sanitize.go new file mode 100644 index 0000000..b93b198 --- /dev/null +++ b/sanitize.go @@ -0,0 +1,63 @@ +package gql + +import ( + "regexp" + "strings" +) + +// Sensitive data patterns to redact from logs +var ( + // Pattern for common sensitive field names in JSON/GraphQL + sensitiveFieldPattern = regexp.MustCompile(`(?i)"?(password|passwd|pwd|token|apikey|api_key|api-key|secret|authorization|auth|bearer|credentials|private_key|private-key|access_token|refresh_token|client_secret|session|cookie)"?\s*:\s*"[^"]*"`) + + // Pattern for authorization headers + authHeaderPattern = regexp.MustCompile(`(?i)(authorization|x-api-key|x-auth-token|bearer)\s*:\s*[^\s,}]+`) + + // Pattern for basic auth in URLs + basicAuthURLPattern = regexp.MustCompile(`(https?://)([^:]+):([^@]+)@`) + + // Pattern for JWT tokens + jwtPattern = regexp.MustCompile(`eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+`) +) + +const redactedText = "[REDACTED]" + +// sanitizeForLogging removes sensitive data from strings before logging +// This includes passwords, tokens, API keys, authorization headers, etc. +func sanitizeForLogging(input string) string { + if input == "" { + return input + } + + // Create a working copy + sanitized := input + + // Redact sensitive fields in JSON/GraphQL + sanitized = sensitiveFieldPattern.ReplaceAllStringFunc(sanitized, func(match string) string { + // Preserve the field name but redact the value + parts := strings.SplitN(match, ":", 2) + if len(parts) == 2 { + fieldName := parts[0] + return fieldName + `: "` + redactedText + `"` + } + return redactedText + }) + + // Redact authorization headers + sanitized = authHeaderPattern.ReplaceAllStringFunc(sanitized, func(match string) string { + parts := strings.SplitN(match, ":", 2) + if len(parts) == 2 { + headerName := parts[0] + return headerName + ": " + redactedText + } + return redactedText + }) + + // Redact basic auth in URLs + sanitized = basicAuthURLPattern.ReplaceAllString(sanitized, "${1}"+redactedText+":"+redactedText+"@") + + // Redact JWT tokens + sanitized = jwtPattern.ReplaceAllString(sanitized, redactedText) + + return sanitized +} diff --git a/structs.go b/structs.go index 7a88dc7..445acf2 100644 --- a/structs.go +++ b/structs.go @@ -2,6 +2,7 @@ package gql import ( "net/http" + "sync" "time" cache "github.com/lukaszraczylo/go-simple-graphql/cache" @@ -9,6 +10,7 @@ import ( ) type BaseClient struct { + mu sync.RWMutex // Protects all fields for thread-safe access cache *cache.Cache Logger *logging.Logger client *http.Client diff --git a/suite_test.go b/suite_test.go index 2433a4d..89e174d 100644 --- a/suite_test.go +++ b/suite_test.go @@ -2,6 +2,7 @@ package gql import ( "net/http/httptest" + "os" "testing" assertions "github.com/stretchr/testify/assert" @@ -13,11 +14,19 @@ type Tests struct { } var ( - assert *assertions.Assertions - mockServer *httptest.Server + assert *assertions.Assertions + mockServer *httptest.Server + originalInsecureSkipValue string ) func (suite *Tests) SetupSuite() { + // Save original environment variable value + originalInsecureSkipValue = os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") + + // Set environment variable to skip TLS verification for test mock server + // The mock server uses self-signed certificates + os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", "true") + // Start mock GraphQL server mockServer = StartMockServer() } @@ -30,6 +39,13 @@ func (suite *Tests) TearDownSuite() { // Cleanup shared test cache CleanupTestCache() + + // Restore original environment variable value + if originalInsecureSkipValue != "" { + os.Setenv("GRAPHQL_INSECURE_SKIP_VERIFY", originalInsecureSkipValue) + } else { + os.Unsetenv("GRAPHQL_INSECURE_SKIP_VERIFY") + } } func (suite *Tests) SetupTest() {