how to limit the amount of the alias
- 主要语言
- Go
- 星标
- 10.8k
- 派生
- 1.3k
- 平均合并
- 2 天 36 分钟
- 30 天内合并 PR
- 26
描述
### What happened?
I can't limit the amount of the alias. FixedComplexityLimit limits the complexity of the query.
### What did you expect?
I want to limit the amount of the alias to prevent the batching attack. Let's try to explain by giving an example.
```
query {
productsByIds(productIds: "353573855") {
active {
id
path
title
}
productsByIds2: productsByIds(productIds: "353573855") {
active {
id
path
title
}
}
```
The above query should give an error. However, the below should work. This is just an example I have more complex schemas that's why the complexity limit didn't work for me.
```
query {
productsByIds(productIds: "353573855") {
active {
id
path
title
}
products {
active {
id
path
title
}
}
}
```
### Minimal graphql.schema and models to reproduce
### versions
- `go run github.com/99designs/gqlgen version` v0.17.22
- `go version` 1.19
贡献指南
调研方向
查看 gqlgen 库中的查询复杂度计算,可能位于验证或执行阶段。该 issue 涉及限制每个查询中的别名数量,以防止 batching 攻击。首先了解 AST 中别名的解析和计数方式。检查 FixedComplexityLimit 等现有的复杂度限制器,参考其中的模式。使用提供的查询示例编写测试即可验证修复。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- go, graphql
- 领域
- backend-api-design, security
- Issue 类型
- 功能
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 45/100