fix: raise a syntax error for truncated string escape sequences

Reading a character past the end of the source yields NaN in GraphQL.js, but
raises an IndexError in Python. A string escape sequence truncated at the end
of the input therefore made the lexer raise an unhandled IndexError instead of
a GraphQLSyntaxError, and that exception propagated out of parse() and
graphql_sync().

Catch that IndexError and fall back to the same sentinels that any other
invalid escape produces, so such an escape is reported as a syntax error with
the same message as in GraphQL.js, while the normal path stays unchanged.

Author: Cito

src/graphql/language/lexer.py

@@ -398,7 +398,10 @@ def read_escaped_unicode_fixed_width(self, position: int) -> EscapeSequence:
     def read_escaped_character(self, position: int) -> EscapeSequence:
         """Read escaped character sequence"""
         body = self.source.body
-        value = _ESCAPED_CHARS.get(body[position + 1])
+        try:
+            value = _ESCAPED_CHARS.get(body[position + 1])
+        except IndexError:  # backslash at the end of the body
+            value = None
         if value:
             return EscapeSequence(value, 2)
         raise GraphQLSyntaxError(
@@ -553,13 +556,18 @@ def read_16_bit_hex_code(body: str, position: int) -> int:
     Returns a negative number if any char was not a valid hexadecimal digit.
     """
     # read_hex_digit() returns -1 on error. ORing a negative value with any other
-    # value always produces a negative value.
-    return (
-        read_hex_digit(body[position]) << 12
-        | read_hex_digit(body[position + 1]) << 8
-        | read_hex_digit(body[position + 2]) << 4
-        | read_hex_digit(body[position + 3])
-    )
+    # value always produces a negative value. An escape sequence truncated at the end
+    # of the body raises an IndexError in Python (in GraphQL.js it reads NaN); it is
+    # reported with the same negative value, keeping the normal path free of checks.
+    try:
+        return (
+            read_hex_digit(body[position]) << 12
+            | read_hex_digit(body[position + 1]) << 8
+            | read_hex_digit(body[position + 2]) << 4
+            | read_hex_digit(body[position + 3])
+        )
+    except IndexError:
+        return -1
 
 
 def read_hex_digit(char: str) -> int:

tests/language/test_lexer.py

@@ -339,6 +339,34 @@ def lex_reports_useful_string_errors():
             "Invalid Unicode escape sequence: '\\uD83D'.",
             (1, 6),
         )
+        # escape sequences truncated at the end of the source; these cases are
+        # specific to GraphQL-core, since in GraphQL.js reading beyond the end of
+        # the source yields NaN instead of raising an IndexError
+        assert_syntax_error(
+            '"bad esc \\', "Invalid character escape sequence: '\\'.", (1, 10)
+        )
+        assert_syntax_error(
+            '"bad esc \\u', "Invalid Unicode escape sequence: '\\u'.", (1, 10)
+        )
+        assert_syntax_error(
+            '"bad esc \\u0', "Invalid Unicode escape sequence: '\\u0'.", (1, 10)
+        )
+        assert_syntax_error(
+            '"bad esc \\u00', "Invalid Unicode escape sequence: '\\u00'.", (1, 10)
+        )
+        assert_syntax_error(
+            '"bad esc \\u000', "Invalid Unicode escape sequence: '\\u000'.", (1, 10)
+        )
+        assert_syntax_error(
+            '"bad surrogate pair \\uD83D\\u',
+            "Invalid Unicode escape sequence: '\\uD83D'.",
+            (1, 21),
+        )
+        assert_syntax_error(
+            '"bad surrogate pair \\uD83D\\uDE',
+            "Invalid Unicode escape sequence: '\\uD83D'.",
+            (1, 21),
+        )
 
     def lexes_block_strings():
         assert lex_one('""""""') == Token(TokenKind.BLOCK_STRING, 0, 6, 1, 1, "")