Skip to content

Escape subscription serializer magic keys - #5722

Open
ydah wants to merge 1 commit into
rmosolgo:masterfrom
ydah:escape-subscription-serializer-magic-keys
Open

Escape subscription serializer magic keys#5722
ydah wants to merge 1 commit into
rmosolgo:masterfrom
ydah:escape-subscription-serializer-magic-keys

Conversation

@ydah

@ydah ydah commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

GraphQL::Subscriptions::Serialize uses single-key Hashes with reserved keys to represent values such as Global IDs, symbols, timestamps, and OpenStructs.

Currently, user-provided Hashes containing those keys are serialized without escaping:

value = { "__gid__" => "gid://app/User/1" }

GraphQL::Subscriptions::Serialize.load(
  GraphQL::Subscriptions::Serialize.dump(value)
)
# => result of GlobalID::Locator.locate(...)

Likewise, a Hash containing __ostruct__ is loaded as an OpenStruct instead of being returned as the original Hash. Collisions with __sym__, __sym_keys__, and __timestamp__ can also change or reject user data.

This can affect subscription arguments and scopes containing client-controlled JSON values.

This PR wraps Hashes whose keys collide with serializer metadata in a dedicated Hash representation using serialized key-value pairs. The wrapper key itself is also escaped recursively.

Hashes without reserved keys keep their existing serialized format, and existing GlobalID, Symbol, timestamp, and OpenStruct payloads continue to deserialize as before.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant