GraphQL API returns all object if given filter is invalid

[valentinesd]

Deployment Type

Self-hosted

NetBox Version

v4.0.7

Python Version

3.10

Steps to Reproduce

My specific use case is vlan_list filtered by site id, but the behavior can be observed across all objects (eg site_list filtered by region_id)
Add VLANs to netbox and perform a GraphQL query similar to below (where 1234567890 is not a valid site)

{
  vlan_list(filters: {site_id: "1234567890"}){
    id
    vid
    site {
      id
    }
    tenant {
      id
    }
  }
}

Expected Behavior

Return an empty list or error, as the filter is not satisfied

Observed Behavior

Returns all objects

[jeremystretch]

This appears to be the same behavior as the web UI: Filtering a list of objects by an invalid foreign key to some other object negates the filter and returns an unfiltered list. (The REST API, however, does return an error.)

[arthanson]

I think some extra logic would be needed here: https://github.com/netbox-community/netbox/blob/develop/netbox/netbox/graphql/filter_mixins.py#L204 as it is just returning the filterset which is returning all the items, REST must have specific logic to catch this case., will need to be ported here.