careful not to interpret Buffer as json-parsed keyed object

Author: leebyron

src/__tests__/http-test.js

@@ -522,6 +522,23 @@ describe('test harness', () => {
         });
       });
 
+      it('does not accept unknown pre-parsed POST raw Buffer', async () => {
+        var app = express();
+        app.use(bodyParser.raw({ type: '*/*' }));
+
+        app.use(urlString(), graphqlHTTP({ schema: TestSchema }));
+
+        var req = request(app)
+          .post(urlString())
+          .set('Content-Type', 'application/graphql');
+        req.write(new Buffer('{ test(who: "World") }'));
+        var error = await catchError(req);
+
+        expect(error.response.status).to.equal(400);
+        expect(JSON.parse(error.response.text)).to.deep.equal({
+          errors: [ { message: 'Must provide query string.' } ]
+        });
+      });
     });
 
     describe('Pretty printing', () => {

src/parseBody.js

@@ -18,8 +18,8 @@ import type { Request } from 'express';
 
 export function parseBody(req: Request, next: NodeCallback): void {
   try {
-    // If express has already parsed a body as an object, use it.
-    if (typeof req.body === 'object') {
+    // If express has already parsed a body as a keyed object, use it.
+    if (typeof req.body === 'object' && !(req.body instanceof Buffer)) {
       return next(null, req.body);
     }