You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
GraphQL service should be able to provide a way to limit the depth of an accepted query, so that too deep queries will not be executed, but invalidated at the validation phase.
Consider the following example, where there is a cyclic reference between the Book and the Author records.
importballerina/graphql;
graphql:ListenerConfigurationconfigs= { maxQueryDepth:3 }
listenergraphql:ListenergraphqlListener=new(9090, configs);
service/graphqlon graphqlListener {
isolatedresourcefunction get book(intid) returnsBook {
// Get Book record from somewhere and return
}
}
typeBookrecord {|string title;
Authorauthor;
|};
typeAuthorrecord {|string name;
Book[] books;
|};
Someone can exploit this cyclic reference to send a too deep query in order to break the service as below:
{
book(id: 1) {
author {
books {
author {
books {
author {
books {
author {
// This can go on like this forever
name
}
}
}
}
}
}
}
}
}
Therefore developers should be able to limit the maximum depth for a query to be valid, before execute it.
GraphQL service should be able to provide a way to limit the depth of an accepted query, so that too deep queries will not be executed, but invalidated at the validation phase.
Consider the following example, where there is a cyclic reference between the Book and the Author records.
Someone can exploit this cyclic reference to send a too deep query in order to break the service as below:
Therefore developers should be able to limit the maximum depth for a query to be valid, before execute it.
Subtask of #710
The text was updated successfully, but these errors were encountered: