QuerydslDataFetcher does not preserve the full path prefix for nested parameters

[zeng-alt]

Describe the Bug

In org.springframework.graphql.data.query.QuerydslDataFetcher, the private method addParameters(...) fails to preserve the parent path prefix when recursively processing nested input arguments. This leads to incorrect flattening of nested object fields into parameter names.

Expected Behavior

Given a GraphQL query with nested object fields, such as:

query {
  userBy(filter: { profile: { name: "test1" } }) {
    id
  }
}

The expected parameter map should include keys like:

{
  "profile.name": ["test1"]
}

But currently it produces:

{
  "name": ["test1"]
}

The profile. prefix is missing.

Actual Behavior

The path prefix is dropped during recursion because the method call:

addParameters(entry.getKey(), (Map<String, Object>) nested, parameters);

does not incorporate the existing prefix. As a result, only the current key is passed as the new prefix, and the hierarchical path is not preserved.

Affected Code

private void addParameters(
    @Nullable String prefix,
    Map<String, Object> arguments,
    MultiValueMap<String, Object> parameters) {

    for (Map.Entry<String, Object> entry : arguments.entrySet()) {
        Object value = entry.getValue();
        if (value instanceof Map<?, ?> nested) {
            addParameters(entry.getKey(), (Map<String, Object>) nested, parameters); // ❌ This line is incorrect
            continue;
        }
        List<Object> values = (value instanceof List) ? (List<Object>) value : Collections.singletonList(value);
        parameters.put(((prefix != null) ? prefix + "." : "") + entry.getKey(), values);
    }
}

Suggested Fix

Update the recursive call to include the full path:

addParameters(
    (prefix != null ? prefix + "." + entry.getKey() : entry.getKey()),
    (Map<String, Object>) nested,
    parameters
);

This ensures nested paths are flattened correctly into fully qualified keys.

Version

• spring-graphql: 1.3.4 (or whichever version you're using)
• Affects: likely all versions since QuerydslDataFetcher was introduced

Impact

This issue causes incorrect behavior when using nested input types (e.g., object fields like profile.name) in queries. It breaks parameter-based filtering when relying on QuerydslBindings.

[rstoyanchev]

The current key is pre-pended at the end of the loop, and we have a test that shows it works for one level of testing. For anything deeper, it is missing the prefix above one level.