From 916714002a65b655c8cacba80be76e55df11367c Mon Sep 17 00:00:00 2001 From: Glen Date: Mon, 14 Sep 2026 12:59:41 +0200 Subject: [PATCH] Reject non-ASCII characters in GraphQL name validation --- .../src/Primitives/Utilities/NameUtils.cs | 4 ++-- .../test/Primitives.Tests/NameUtilsTests.cs | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/src/HotChocolate/Primitives/src/Primitives/Utilities/NameUtils.cs b/src/HotChocolate/Primitives/src/Primitives/Utilities/NameUtils.cs index 35c6e538c2f..d11457652ef 100644 --- a/src/HotChocolate/Primitives/src/Primitives/Utilities/NameUtils.cs +++ b/src/HotChocolate/Primitives/src/Primitives/Utilities/NameUtils.cs @@ -147,7 +147,7 @@ public static bool IsValidGraphQLName(this in ReadOnlySpan name) [MethodImpl(MethodImplOptions.AggressiveInlining)] private static bool IsLetterOrDigitOrUnderscore(this char c) - => IsLetterOrDigitOrUnderscore((byte)c); + => c is >= 'a' and <= 'z' or >= 'A' and <= 'Z' or >= '0' and <= '9' or '_'; [MethodImpl(MethodImplOptions.AggressiveInlining)] private static bool IsLetterOrDigitOrUnderscore(this byte c) @@ -188,5 +188,5 @@ private static bool IsLetterOrUnderscore(this byte c) [MethodImpl(MethodImplOptions.AggressiveInlining)] private static bool IsLetterOrUnderscore(this char c) - => IsLetterOrUnderscore((byte)c); + => c is >= 'a' and <= 'z' or >= 'A' and <= 'Z' or '_'; } diff --git a/src/HotChocolate/Primitives/test/Primitives.Tests/NameUtilsTests.cs b/src/HotChocolate/Primitives/test/Primitives.Tests/NameUtilsTests.cs index 05ee5705fa1..3b774a02a92 100644 --- a/src/HotChocolate/Primitives/test/Primitives.Tests/NameUtilsTests.cs +++ b/src/HotChocolate/Primitives/test/Primitives.Tests/NameUtilsTests.cs @@ -10,6 +10,9 @@ public class NameUtilsTests [InlineData("1_Bar")] [InlineData("B/ar")] [InlineData("B+ar")] + [InlineData("Łar")] + [InlineData("Bŗar")] + [InlineData("Bİar")] public void InvalidName(string name) { var message = Assert.Throws(() => name.EnsureGraphQLName()).Message; @@ -33,4 +36,19 @@ public void ValidName(string name) { name.EnsureGraphQLName(); } + + [Theory] + [InlineData("Łar", "_ar")] + [InlineData("Bŗar", "B_ar")] + [InlineData("Bİar", "B_ar")] + public void MakeValidGraphQLName_Should_ReplaceTheCharacter_When_ItIsNotAnAsciiNameCharacter( + string name, + string expected) + { + // act + var result = NameUtils.MakeValidGraphQLName(name); + + // assert + Assert.Equal(expected, result); + } }