Open Policy Agent implements a pruneIrrelevantGraphQLASTNodes() func that removes position information from the GraphQL AST.
This causes issues on the ErrorPosf() path because that function assumes that the pos *ast.Position argument will not be nil.
The result is that it is easy to crash Open Policy Agent with bad input as you can see in this playground that results in runtime error: invalid memory address or nil pointer dereference.
I think the best fix here is to add a nil check to ErrorPosf(), but perhaps there are better solutions.
Open Policy Agent implements a pruneIrrelevantGraphQLASTNodes() func that removes position information from the GraphQL AST.
This causes issues on the ErrorPosf() path because that function assumes that the
pos *ast.Positionargument will not be nil.The result is that it is easy to crash Open Policy Agent with bad input as you can see in this playground that results in
runtime error: invalid memory address or nil pointer dereference.I think the best fix here is to add a nil check to
ErrorPosf(), but perhaps there are better solutions.