fix(graphql): handle malformed queries with extra quotes

[sentry]

This PR addresses a GraphQLSyntaxError that occurred when clients sent GraphQL queries with the entire query string wrapped in an additional layer of double-quotes within the JSON body. This caused the lexer to misinterpret parts of the query (e.g., 1024XEngineer) as invalid numbers after prematurely closing a string literal.

Changes Made:

1. get_clean_query modification: The get_clean_query method in apps/codecov-api/graphql_api/views.py has been updated to detect and strip any extraneous surrounding double-quotes from the GraphQL query string. This ensures that the query passed for further processing is correctly formatted.
2. post method update: The post method now rewrites request._body with the normalized query string. This is crucial because the ariadne parser, which is called by the parent GraphQLAsyncView, reads directly from request.body. By updating request._body, we ensure that the parser receives the corrected, unquoted query, preventing the GraphQLSyntaxError.

This fix improves the robustness of the GraphQL API against malformed client requests, specifically those that incorrectly double-quote the query field in the JSON payload.

Legal Boilerplate

Look, I get it. The entity doing business as "Codecov" is owned by Harness, Inc. In 2026 Harness acquired Codecov and as a result Harness is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Harness can use, modify, copy, and redistribute my contributions, under Harness's choice of terms.

Fixes API-EZE

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

[thomasrockhu-codecov]

✨ Harness AI Code Review

View in Harness →

🛑 Risk: MEDIUM

This PR strips accidental surrounding double-quotes from GraphQL queries and rewrites request._body so ariadne's parent view parses the normalized query. The most important issue: rewriting request._body with the output of get_clean_query promotes previously log-only, lossy normalization (replace(" ", "") and newline collapsing) into the query that is actually parsed — corrupting string/block-string literals that contain double-spaces or newlines. The quote-stripping fix should be applied to the parsed body in isolation, leaving the lossy cleanup for logging only.

Top findings

• HIGH · BUSINESS-LOGIC apps/codecov-api/graphql_api/views.py:258 — Lossy log-cleaning is now fed to the parser via request._body, corrupting whitespace inside string literals.
• MEDIUM · TEST-GAP apps/codecov-api/graphql_api/views.py:231 — New quote-stripping and body-rewrite path is untested.