99designs / 99designs/gqlgen

Resource exhaustion when handling of crafted queries

未关闭
#2,892 0 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Go
星标
10.8k
派生
1.3k
平均合并
2 天 36 分钟
30 天内合并 PR
26

描述

### What happened?

When a crafted query is received, it significantly exhausts computing resources like the CPU, which negatively impacts response time.

### What did you expect?

I expected return an error immediately.

### Minimal graphql.schema and models to reproduce

```shell
$ go run github.com/99designs/gqlgen init
$ go run server.go

$ PAYLOAD=$(python3 -c "print('%s' % ('id ' * 5000))")
$ time curl \
--data-raw "{\"query\":\"query Todo { todos { $PAYLOAD } }\"}" \
--header 'Content-Type: application/json' \
--include \
--request POST \
http://localhost:8080/query
```

This query takes approximately 2.5 seconds to process. If the number of id is increased to 10000, the processing time increases to about 8 seconds.
The attached frame graph illustrates the system's response when the id is increased to `100000`.
The `validator.Validate` function takes so long, that it appears unlikely to be mitigated by either the Complexity Extension or our custom Extension.

![スクリーンショット 2024-01-30 13 52 08](https://github.com/99designs/gqlgen/assets/5842353/8bbbf354-6be5-463a-ab39-0560b303743f)

Any ideas or suggestions on how to mitigate this would be helpful.

### versions
- `go run github.com/99designs/gqlgen version`? ... `v0.17.43`
- `go version`? ... `go version go1.21.3 darwin/arm64`

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。