deactivated deep munge

config/application.rb

@@ -92,6 +92,14 @@ class Application < Rails::Application
     # Skip views, helpers and assets when generating a new resource.
     config.api_only = true
 
+    # Rails' deep_munge strips `null` entries out of any Array in `params` (but not out of
+    # Hash values), which silently drops nulls from array-typed GraphQL variables (e.g. a
+    # literalValue array containing null). GraphQL-ruby validates all variables against the
+    # schema's declared types before they reach resolver code, so the SQL-injection-style
+    # scenario deep_munge guards against (raw params arrays landing in ActiveRecord `where`
+    # clauses) doesn't apply to our GraphQL variable handling.
+    config.action_dispatch.perform_deep_munge = false
+
     # Autofix after generators
     config.generators.after_generate do |files|
       parsable_files = files.filter { |file| file.end_with?('.rb') }

spec/requests/graphql/mutation/namespace/projects/flows/update_mutation_spec.rb

@@ -303,6 +303,30 @@
         expect(setting.object).to be_nil
       end
     end
+
+    context 'when a literal value contains an array with a null entry' do
+      before do
+        input[:flowInput][:nodes][0][:parameters][0][:value][:literalValue][:value] = [1, nil, 3]
+      end
+
+      it 'preserves the null entry when persisted' do
+        mutate!
+
+        flow_nodes = graphql_data_at(:namespaces_projects_flows_update, :flow, :nodes, :nodes)
+        parameter_response = flow_nodes
+                             .flat_map { |node| node['parameters']['nodes'] }
+                             .find do |parameter|
+          parameter.dig(
+            'value', '__typename'
+          ) == 'LiteralValue'
+        end
+
+        expect(parameter_response['value']['value']).to eq([1, nil, 3])
+
+        parameter = SagittariusSchema.object_from_id(parameter_response['id'])
+        expect(parameter.reload.literal_value).to eq([1, nil, 3])
+      end
+    end
   end
 
   context 'when updating a sub-flow by function identifier' do

spec/requests/graphql_spec.rb

@@ -177,4 +177,20 @@
       expect(response.body).to be_empty
     end
   end
+
+  describe 'variable parsing' do
+    it 'preserves null entries nested inside array variables' do
+      captured_variables = nil
+      allow(SagittariusSchema).to receive(:execute) do |*_args, **kwargs|
+        captured_variables = kwargs[:variables]
+        { 'data' => {} }
+      end
+
+      post graphql_path,
+           headers: { 'content-type': 'application/json' },
+           params: { query: query, variables: { list: [1, nil, 3], scalar: nil } }.to_json
+
+      expect(captured_variables).to eq('list' => [1, nil, 3], 'scalar' => nil)
+    end
+  end
 end