fix(dataproducer): missing isRouted and access check (#1305)

drupal-graphql · Sep 23, 2022 · 31c4753 · 31c4753
1 parent ffed89b
commit 31c4753
Show file tree

Hide file tree

Showing 3 changed files with 65 additions and 7 deletions.
diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
@@ -85,6 +85,7 @@ jobs:
  run: composer --no-interaction --no-progress require \
  webonyx/graphql-php:^14.8 \
  drupal/typed_data:^1.0 \
+ drupal/redirect:^1.0 \
  phpstan/phpstan:^1.7.14 \
  mglaman/phpstan-drupal:^1.1.2 \
  phpstan/phpstan-deprecation-rules:^1.0.0 \

diff --git a/src/Plugin/GraphQL/DataProducer/Routing/RouteLoad.php b/src/Plugin/GraphQL/DataProducer/Routing/RouteLoad.php
@@ -95,15 +95,15 @@ public function __construct(
  * @return \Drupal\Core\Url|null
  */
  public function resolve($path, RefinableCacheableDependencyInterface $metadata) {
- if ($this->redirectRepository) {
-  /** @var \Drupal\redirect\Entity\Redirect|null $redirect */
- $redirect = $this->redirectRepository->findMatchingRedirect($path, []);
-  if ($redirect) {
-  return $redirect->getRedirectUrl();
- }
+ $redirect = $this->redirectRepository ? $this->redirectRepository->findMatchingRedirect($path, []) : NULL;
+ if ($redirect !== NULL) {
+ $url = $redirect->getRedirectUrl();
+ }
+ else {
+ $url = $this->pathValidator->getUrlIfValidWithoutAccessCheck($path);
  }
 
- if (($url = $this->pathValidator->getUrlIfValidWithoutAccessCheck($path)) && $url->isRouted() && $url->access()) {
+ if ($url && $url->isRouted() && $url->access()) {
  return $url;
  }
 

diff --git a/tests/src/Kernel/DataProducer/RoutingTest.php b/tests/src/Kernel/DataProducer/RoutingTest.php
@@ -2,6 +2,8 @@
 
 namespace Drupal\Tests\graphql\Kernel\DataProducer;
 
+use Drupal\node\Entity\Node;
+use Drupal\node\Entity\NodeType;
 use Drupal\Tests\graphql\Kernel\GraphQLTestBase;
 
 /**
@@ -11,6 +13,25 @@
  */
 class RoutingTest extends GraphQLTestBase {
 
+ /**
+ * {@inheritdoc}
+ */
+ protected static $modules = [
+ 'redirect',
+ 'views',
+ 'path_alias',
+ ];
+
+ /**
+ * {@inheritdoc}
+ */
+ public function setUp(): void {
+ parent::setUp();
+
+ $this->installEntitySchema('redirect');
+ $this->installConfig(['redirect']);
+ }
+
  /**
  * @covers \Drupal\graphql\Plugin\GraphQL\DataProducer\Routing\RouteLoad::resolve
  */
@@ -21,6 +42,42 @@ public function testRouteLoad(): void {
 
  $this->assertNotNull($result);
  $this->assertEquals('user.logout', $result->getRouteName());
+
+ // Test route_load with redirect to an internal URL.
+ NodeType::create([
+ 'type' => 'test',
+ 'name' => 'Test',
+ ])->save();
+ $node = Node::create([
+ 'title' => 'Node',
+ 'type' => 'test',
+ ]);
+ $node->save();
+ $nodeUrl = $node->toUrl()->toString();
+
+ /** @var \Drupal\redirect\Entity\Redirect $redirect */
+ $redirect = $this->container->get('entity_type.manager')->getStorage('redirect')->create();
+ $redirect->setSource('internal-url');
+ $redirect->setRedirect($nodeUrl);
+ $redirect->save();
+
+ /** @var \Drupal\Core\Url $result */
+ $result = $this->executeDataProducer('route_load', [
+ 'path' => 'internal-url',
+ ]);
+
+ $this->assertNotNull($result);
+ $this->assertEquals($nodeUrl, $result->toString());
+
+ $redirect->setSource('external-url');
+ $redirect->setRedirect('https://example.com');
+ $redirect->save();
+
+ $result = $this->executeDataProducer('route_load', [
+ 'path' => 'external-url',
+ ]);
+
+ $this->assertNull($result, 'Route to external URL should not be found.');
  }
 
  /**