QUALITY PATCH

ACP2E-4194: Issue where GraphQL requests with unknown filter names cause PHP exception logs

Issue where GraphQL requests with unknown filter names cause PHP exception logs. Quality patch ACP2E-4194 for magento/framework applies to Magento Open Source and Adobe Commerce 2.4.7-p10 to 2.4.8-p5.

Categories
GraphQL
Components
magento/framework, magento/module-graph-ql, magento/theme-frontend-blank, magento/theme-frontend-luma
Origin
adobe-commerce-support
Since QPT
1.1.82

Issue

Issue where GraphQL requests with unknown filter names cause PHP exception logs.

Steps to reproduce

Send a GraphQL request that has an unknown or incorrect filter name: query Test($filter: FindFilterType){ cmsBlocks(identifiers:["home"]) { items { title } } }

Adobe's page lists 2.4.7-p10, 2.4.8-p5 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.9.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACP2E-4194. On Cloud, add ACP2E-4194 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACP2E-4194/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

Packages across compatible versions (4): magento/module-graph-ql, magento/theme-frontend-blank, magento/theme-frontend-luma, magento/framework
Packages across compatible versions (4): magento/module-graph-ql, magento/theme-frontend-blank, magento/theme-frontend-luma, magento/framework

magento/magento2-base >=2.4.7-p10 <2.4.8

Magento Open Source
2.4.7-p10
Adobe Commerce
2.4.7-p10
Replaced with
ACP2E-4815
Patch file
patches/os/ACP2E-4969_2.4.7-p10.patch
  • vendor/magento/module-graph-ql/Controller/GraphQl.php
  • vendor/magento/module-graph-ql/Controller/HttpRequestValidator/ContentTypeValidator.php
  • vendor/magento/module-graph-ql/Controller/HttpRequestValidator/HttpVerbValidator.php
  • vendor/magento/theme-frontend-blank/i18n/en_US.csv
  • vendor/magento/theme-frontend-luma/i18n/en_US.csv
  • vendor/magento/framework/GraphQl/Exception/InvalidRequestInterface.php (added)
  • vendor/magento/framework/GraphQl/Exception/MethodNotAllowedException.php (added)
  • vendor/magento/framework/GraphQl/Exception/UnsupportedMediaTypeException.php (added)
  • vendor/magento/framework/GraphQl/Schema/SchemaGenerator.php
  • vendor/magento/framework/GraphQl/Schema/Type/TypeRegistry.php

magento/magento2-base >=2.4.8-p5 <2.4.9

Magento Open Source
2.4.8-p5
Adobe Commerce
2.4.8-p5
Patch file
patches/os/ACP2E-4955_2.4.8-p5.patch
  • vendor/magento/module-graph-ql/Controller/GraphQl.php
  • vendor/magento/module-graph-ql/Controller/HttpRequestValidator/ContentTypeValidator.php
  • vendor/magento/module-graph-ql/Controller/HttpRequestValidator/HttpVerbValidator.php
  • vendor/magento/theme-frontend-blank/i18n/en_US.csv
  • vendor/magento/theme-frontend-luma/i18n/en_US.csv
  • vendor/magento/framework/GraphQl/Exception/InvalidRequestInterface.php (added)
  • vendor/magento/framework/GraphQl/Exception/MethodNotAllowedException.php (added)
  • vendor/magento/framework/GraphQl/Exception/UnsupportedMediaTypeException.php (added)
  • vendor/magento/framework/GraphQl/Schema/SchemaGenerator.php
  • vendor/magento/framework/GraphQl/Schema/Type/TypeRegistry.php

Sources

Łukasz Bajsarowicz
Built by

Łukasz Bajsarowicz, e-commerce architect

Magento and Adobe Commerce architecture, upgrades, performance and audits for merchants and agencies since 2015; magento.watch is the tooling I use on those projects.

Open source, maintained on weekends.