\Laragraph\Utils\RequestParser::bodyParams incorrectly includes GET parameters

[JakeBooher]

Describe the bug

Within \Laragraph\Utils\RequestParser::bodyParams it instantiates $bodyParams using $request->input(). This includes GET parameters in the URL, not just the body parameters

Expected behavior/Solution

\Laragraph\Utils\RequestParser::bodyParams should only include bodyParams by using $request->post() instead.

[spawnia]

Can you provide a pull request with a failing test case? Also, how did you discover this? Did it cause problems when it came up?

[JakeBooher]

Yeah, I should be able to do that shortly.

We have a GraphQL API using rebing/graphql-laravel, and add a GET parameter with the list of operations being run so our access logs / monitoring tools have more useful information.

Essentially - if you request https://api.com/graphql?operation=Some,Operation,Names it triggers an error:

GraphQL\\Server\\OperationParams::create(): Argument #1 ($params) must be of type array, string given, called in /srv/application/vendor/webonyx/graphql-php/src/Server/Helper.php on line 127

[spawnia]

Makes sense. I don't see how changing this would break legitimate use cases.

[JakeBooher]

#25 has an example test with it in a broken state, #26 has this test, as well as the fix

[spawnia]

Thank you @JakeBooher, released with https://github.com/laragraph/utils/releases/tag/v2.3.1. Please consider sponsoring.