Skip to content

Commit 60f90a9

Browse files
authored
chore: migrate to main branch (graphql#1325)
1 parent 615b1ae commit 60f90a9

File tree

13 files changed

+27
-27
lines changed

13 files changed

+27
-27
lines changed

README.md

+10-10
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ $ brew install --cask graphql-playground
4242
-`koaPlayground()`
4343
-`lambdaPlayground()
4444

45-
> If you used static values, such as `graphql-playground-electron` does in [it's webpack config](https://github.com/prisma-labs/graphql-playground/blob/master/packages/graphql-playground-electron/webpack.config.build.js#L16), as well as the most common middleware implementations out there, they were not vulnerable to the attack.
45+
> If you used static values, such as `graphql-playground-electron` does in [it's webpack config](https://github.com/prisma-labs/graphql-playground/blob/main/packages/graphql-playground-electron/webpack.config.build.js#L16), as well as the most common middleware implementations out there, they were not vulnerable to the attack.
4646
4747
The only reason this vulnerability exists is because we are using template strings in `renderPlaygroundPage()` with potentially unsanitized user defined variables. This allows an attacker to inject html and javascript into the page.
4848
- [Read more about preventing XSS in react](https://pragmaticwebsecurity.com/files/cheatsheets/reactxss.pdf)
@@ -58,14 +58,14 @@ Common examples may be user-defined path parameters, query string, unsanitized U
5858
- `graphql-playground-koa` **☔ safe** @ `1.6.15`
5959
- `graphql-playground-hapi` **☔ safe** @ `1.6.13`
6060
- `graphql-playground-lambda` **☔ safe** @ `1.7.17`
61-
- `graphql-playground-electron` has always been **☔ safe** from XSS attacks! This is because configuration is statically defined [it's webpack config](https://github.com/prisma-labs/graphql-playground/blob/master/packages/graphql-playground-electron/webpack.config.build.js#L16)
61+
- `graphql-playground-electron` has always been **☔ safe** from XSS attacks! This is because configuration is statically defined [it's webpack config](https://github.com/prisma-labs/graphql-playground/blob/main/packages/graphql-playground-electron/webpack.config.build.js#L16)
6262
- `graphql-playground-react` is safe because it does not use `renderPlaygroundPage()` anywhere, and thus is not susceptible to template string XSS reflection attacks.
6363

6464
### More Information
6565

6666
See the [security docs](./SECURITY.md) for more details on how your implementation might be impacted by this vulnerability. It contains safe examples, unsafe examples, workarounds, and more details.
6767

68-
We've also provided ['an example of the xss using the express middleware]('https://github.com/prisma-labs/graphql-playground/tree/master/packages/graphql-playground-html/examples/xss-attack')
68+
We've also provided ['an example of the xss using the express middleware]('https://github.com/prisma-labs/graphql-playground/tree/main/packages/graphql-playground-html/examples/xss-attack')
6969

7070
## FAQ
7171

@@ -135,7 +135,7 @@ The React component `<Playground />` and all middlewares expose the following op
135135
- `endpoint` [`string`](optional) - the GraphQL endpoint url.
136136
- `subscriptionEndpoint` [`string`](optional) - the GraphQL subscriptions endpoint url.
137137
- `workspaceName` [`string`](optional) - in case you provide a GraphQL Config, you can name your workspace here
138-
- `config` [`string`](optional) - the JSON of a GraphQL Config. See an example [here](https://github.com/prismagraphql/graphql-playground/blob/master/packages/graphql-playground-react/src/localDevIndex.tsx#L47)
138+
- `config` [`string`](optional) - the JSON of a GraphQL Config. See an example [here](https://github.com/prismagraphql/graphql-playground/blob/main/packages/graphql-playground-react/src/localDevIndex.tsx#L47)
139139
- `settings` [`ISettings`](optional) - Editor settings in json format as [described here](https://github.com/prismagraphql/graphql-playground#settings)
140140

141141
```ts
@@ -185,10 +185,10 @@ In addition to this, the React app provides some more properties:
185185

186186
If you simply want to render the Playground HTML on your own, for example when implementing a GraphQL Server, there are 2 options for you:
187187

188-
1. [The bare minimum HTML needed to render the Playground](https://github.com/prismagraphql/graphql-playground/blob/master/packages/graphql-playground-html/minimal.html)
189-
2. [The Playground HTML with full loading animation](https://github.com/prismagraphql/graphql-playground/blob/master/packages/graphql-playground-html/withAnimation.html)
188+
1. [The bare minimum HTML needed to render the Playground](https://github.com/prismagraphql/graphql-playground/blob/main/packages/graphql-playground-html/minimal.html)
189+
2. [The Playground HTML with full loading animation](https://github.com/prismagraphql/graphql-playground/blob/main/packages/graphql-playground-html/withAnimation.html)
190190

191-
Note: In case you do not want to serve assets from a CDN (like jsDelivr) and instead use a local copy, you will need to install `graphql-playground-react` from npm, and then replace all instances of `//cdn.jsdelivr.net/npm` with `./node_modules`. An example can be found [here](https://github.com/prismagraphql/graphql-playground/blob/master/packages/graphql-playground-html/minimalWithoutCDN.html)
191+
Note: In case you do not want to serve assets from a CDN (like jsDelivr) and instead use a local copy, you will need to install `graphql-playground-react` from npm, and then replace all instances of `//cdn.jsdelivr.net/npm` with `./node_modules`. An example can be found [here](https://github.com/prismagraphql/graphql-playground/blob/main/packages/graphql-playground-html/minimalWithoutCDN.html)
192192

193193
### As React Component
194194

@@ -249,11 +249,11 @@ yarn add graphql-playground-middleware-lambda
249249

250250
We have a full example for each of the frameworks below:
251251

252-
- **Express:** See [packages/graphql-playground-middleware-express/examples/basic](https://github.com/prismagraphql/graphql-playground/tree/master/packages/graphql-playground-middleware-express/examples/basic)
252+
- **Express:** See [packages/graphql-playground-middleware-express/examples/basic](https://github.com/prismagraphql/graphql-playground/tree/main/packages/graphql-playground-middleware-express/examples/basic)
253253

254-
- **Hapi:** See [packages/graphql-playground-middleware-hapi](https://github.com/prismagraphql/graphql-playground/tree/master/packages/graphql-playground-middleware-hapi)
254+
- **Hapi:** See [packages/graphql-playground-middleware-hapi](https://github.com/prismagraphql/graphql-playground/tree/main/packages/graphql-playground-middleware-hapi)
255255

256-
- **Koa:** See [packages/graphql-playground-middleware-koa](https://github.com/prismagraphql/graphql-playground/tree/master/packages/graphql-playground-middleware-koa)
256+
- **Koa:** See [packages/graphql-playground-middleware-koa](https://github.com/prismagraphql/graphql-playground/tree/main/packages/graphql-playground-middleware-koa)
257257

258258
- **Lambda (as serverless handler):** See [serverless-graphql-apollo](https://github.com/serverless/serverless-graphql-apollo) or a quick example below.
259259

SECURITY.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ When using
1717

1818
without sanitization of user input, your application is vulnerable to an XSS Reflecton Attack. This is a serious vulnerability that could allow for exfiltration of data or user credentials, or to disrupt systems.
1919

20-
We've provided ['an example of the xss using the express middleware]('https://github.com/prisma-labs/graphql-playground/tree/master/packages/graphql-playground-middleware-express/examples/xss-attack')
20+
We've provided ['an example of the xss using the express middleware]('https://github.com/prisma-labs/graphql-playground/tree/main/packages/graphql-playground-middleware-express/examples/xss-attack')
2121

2222
### Impacted Packages
2323

lerna.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"useWorkspaces": true,
66
"command": {
77
"publish": {
8-
"allowBranch": ["master"],
8+
"allowBranch": ["main"],
99
"preDistTag": "next",
1010
"distTag": "latest",
1111
"conventionalCommits": true

packages/graphql-playground-html/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "graphql-playground-html",
33
"version": "1.6.29",
4-
"homepage": "https://github.com/graphcool/graphql-playground/tree/master/packages/graphql-playground-html",
4+
"homepage": "https://github.com/graphcool/graphql-playground/tree/main/packages/graphql-playground-html",
55
"description": "GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration).",
66
"contributors": [
77
"Tim Suchanek <[email protected]>",

packages/graphql-playground-middleware-express/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ npm install graphql-playground-middleware-express --save
1919

2020
## Usage
2121

22-
See full example in [examples/basic](https://github.com/prisma/graphql-playground/tree/master/packages/graphql-playground-middleware-express/examples/basic).
22+
See full example in [examples/basic](https://github.com/prisma/graphql-playground/tree/main/packages/graphql-playground-middleware-express/examples/basic).
2323

2424
```js
2525
const express = require('express')
@@ -33,7 +33,7 @@ app.get('/playground', expressPlayground({ endpoint: '/graphql' }))
3333

3434
## Security Notes
3535

36-
All versions before `1.7.16` were vulnerable to user-defined input to `expressPlayground()`. Read more in [the security notes](https://github.com/prisma/graphql-playground/tree/master/SECURITY.md)
36+
All versions before `1.7.16` were vulnerable to user-defined input to `expressPlayground()`. Read more in [the security notes](https://github.com/prisma/graphql-playground/tree/main/SECURITY.md)
3737

3838
### Security Upgrade Steps
3939

packages/graphql-playground-middleware-express/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "graphql-playground-middleware-express",
33
"version": "1.7.22",
4-
"homepage": "https://github.com/graphcool/graphql-playground/tree/master/packages/graphql-playground-middleware-express",
4+
"homepage": "https://github.com/graphcool/graphql-playground/tree/main/packages/graphql-playground-middleware-express",
55
"description": "GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration).",
66
"contributors": [
77
"Tim Suchanek <[email protected]>",

packages/graphql-playground-middleware-hapi/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ npm install graphql-playground-middleware-hapi --save
1919

2020
## Usage
2121

22-
See full example in [examples/basic](https://github.com/prisma/graphql-playground/tree/master/packages/graphql-playground-middleware-hapi/examples/basic).
22+
See full example in [examples/basic](https://github.com/prisma/graphql-playground/tree/main/packages/graphql-playground-middleware-hapi/examples/basic).
2323

2424
minimal example:
2525

@@ -44,7 +44,7 @@ app.register(playground)
4444

4545
## Security Notes
4646

47-
All versions before `1.6.13` were vulnerable to user-defined input to `hapiPlayground()`. Read more in [the security notes](https://github.com/prisma/graphql-playground/tree/master/SECURITY.md)
47+
All versions before `1.6.13` were vulnerable to user-defined input to `hapiPlayground()`. Read more in [the security notes](https://github.com/prisma/graphql-playground/tree/main/SECURITY.md)
4848

4949
### Security Upgrade Steps
5050

packages/graphql-playground-middleware-hapi/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "graphql-playground-middleware-hapi",
33
"version": "1.6.19",
4-
"homepage": "https://github.com/graphcool/graphql-playground/tree/master/packages/graphql-playground-middleware-hapi",
4+
"homepage": "https://github.com/graphcool/graphql-playground/tree/main/packages/graphql-playground-middleware-hapi",
55
"description": "GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration).",
66
"contributors": [
77
"Tim Suchanek <[email protected]>",

packages/graphql-playground-middleware-koa/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ npm install graphql-playground-middleware-koa --save
1919

2020
## Usage
2121

22-
See full example in [examples/basic](https://github.com/prisma/graphql-playground/tree/master/packages/graphql-playground-middleware-koa/examples/basic).
22+
See full example in [examples/basic](https://github.com/prisma/graphql-playground/tree/main/packages/graphql-playground-middleware-koa/examples/basic).
2323

2424
```js
2525
const koa = require('koa')
@@ -34,7 +34,7 @@ router.all('/playground', koaPlayground({ endpoint: '/graphql' }))
3434

3535
## Security Notes
3636

37-
All versions before `1.6.15` were vulnerable to user-defined input to `koaPlayground()`. Read more in [the security notes](https://github.com/prisma/graphql-playground/tree/master/SECURITY.md)
37+
All versions before `1.6.15` were vulnerable to user-defined input to `koaPlayground()`. Read more in [the security notes](https://github.com/prisma/graphql-playground/tree/main/SECURITY.md)
3838

3939
### Security Upgrade Steps
4040

packages/graphql-playground-middleware-koa/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "graphql-playground-middleware-koa",
33
"version": "1.6.21",
4-
"homepage": "https://github.com/graphcool/graphql-playground/tree/master/packages/graphql-playground-middleware-koa",
4+
"homepage": "https://github.com/graphcool/graphql-playground/tree/main/packages/graphql-playground-middleware-koa",
55
"description": "GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration).",
66
"contributors": [
77
"Tim Suchanek <[email protected]>",

packages/graphql-playground-middleware-lambda/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ npm install graphql-playground-middleware-lambda --save
1919

2020
## Usage
2121

22-
See full example in [examples/basic](https://github.com/prisma/graphql-playground/tree/master/packages/graphql-playground-middleware-lambda/examples/basic).
22+
See full example in [examples/basic](https://github.com/prisma/graphql-playground/tree/main/packages/graphql-playground-middleware-lambda/examples/basic).
2323

2424
minimal example:
2525

packages/graphql-playground-middleware-lambda/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "graphql-playground-middleware-lambda",
33
"version": "1.7.23",
4-
"homepage": "https://github.com/graphcool/graphql-playground/tree/master/packages/graphql-playground-middleware-lambda",
4+
"homepage": "https://github.com/graphcool/graphql-playground/tree/main/packages/graphql-playground-middleware-lambda",
55
"description": "GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration).",
66
"contributors": [
77
"Tim Suchanek <[email protected]>",

packages/graphql-playground-react/README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -108,11 +108,11 @@ yarn add graphql-playground-middleware-lambda
108108

109109
We have a full example for each of the frameworks below:
110110

111-
- **Express:** See [packages/graphql-playground-middleware-express/examples/basic](https://github.com/prisma/graphql-playground/tree/master/packages/graphql-playground-middleware-express/examples/basic)
111+
- **Express:** See [packages/graphql-playground-middleware-express/examples/basic](https://github.com/prisma/graphql-playground/tree/main/packages/graphql-playground-middleware-express/examples/basic)
112112

113-
- **Hapi:** See [packages/graphql-playground-middleware/examples/hapi](https://github.com/prisma/graphql-playground/tree/master/packages/graphql-playground-middleware-hapi/examples/basic)
113+
- **Hapi:** See [packages/graphql-playground-middleware/examples/hapi](https://github.com/prisma/graphql-playground/tree/main/packages/graphql-playground-middleware-hapi/examples/basic)
114114

115-
- **Koa:** See [packages/graphql-playground-middleware/examples/koa](https://github.com/prisma/graphql-playground/tree/master/packages/graphql-playground-middleware-koa/examples/basic)
115+
- **Koa:** See [packages/graphql-playground-middleware/examples/koa](https://github.com/prisma/graphql-playground/tree/main/packages/graphql-playground-middleware-koa/examples/basic)
116116

117117
- **Lambda (as serverless handler):** See [serverless-graphql-apollo](https://github.com/serverless/serverless-graphql-apollo) or a quick example below.
118118

0 commit comments

Comments
 (0)