fix: string-literal-aware normalization (prevents query corruption + hash collisions) - #18
Conversation
normalizeQuery stripped # comments and collapsed whitespace across the
whole query, including inside string literals. A query like
{ user(bio: "a # b") { name } } was truncated at the # to
{user(bio:"a — destroying everything after it and colliding with any
other query that truncates to the same prefix. Whitespace inside strings
was also collapsed, so distinct string values hashed identically.
Tokenize the query so string and block-string literals are preserved
verbatim while comment-stripping and whitespace normalization apply only
to the surrounding source. Handles escaped quotes and triple-quoted block
strings. Adds regression tests.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19ed115584
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8459fd209b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ) { | ||
| backslashes += 1; | ||
| } | ||
| if (end === -1 || backslashes % 2 === 0) { |
There was a problem hiding this comment.
When an escaped triple quote in a valid block string is immediately preceded by another backslash, GraphQL treats the first backslash as content and the second as the escape introducer, so the triple quote remains content. This parity check instead considers the two backslashes even and closes the block; a following # is then stripped as a comment, truncating the normalized operation and allowing distinct valid operations to collide. The newly added even/odd-backslash check is fresh evidence that the earlier escaped-triple-quote issue remains for this valid variant; a block-string triple quote should be considered escaped whenever its immediately preceding character is a backslash.
Useful? React with 👍 / 👎.
1 participant
Bug:
normalizeQuerystripped#comments and collapsed whitespace across the entire query, including inside string literals.{ user(bio: "a # b") { name } }was truncated at the#to{user(bio:"a— everything after was lost, colliding with any other query truncating to the same prefix."a b"and"a b"(distinct values) hashed identically.Fix: tokenize so string and
"""block"""literals are preserved verbatim, while comment-stripping and whitespace normalization apply only to surrounding source. Honors escaped quotes. All existing tests still pass; added 5 regression tests.ultracite checkclean.